Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe

Overview

General Information

Sample name:8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe
Analysis ID:1564558
MD5:bd29364f916d0e1bba479e785773e00e
SHA1:7f6a2fee536af37dcfbd46d316c061ba63bc7fd7
SHA256:95061805157fafa10b3587bb9a2aae6e149e5ac7c7829f648ad8a988d78efe59
Tags:exefat7ola0077-ddns-netuser-JAMESWT_MHT
Infos:

Detection

AsyncRAT, PureLog Stealer, zgRAT
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Found malware configuration
Malicious sample detected (through community Yara rule)
Suricata IDS alerts for network traffic
Yara detected AsyncRAT
Yara detected BrowserPasswordDump
Yara detected PureLog Stealer
Yara detected zgRAT
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Contains functionality to log keystrokes (.Net Source)
Machine Learning detection for sample
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Uses dynamic DNS services
Yara detected Costura Assembly Loader
Yara detected Generic Downloader
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains long sleeps (>= 3 min)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Stores large binary data to the registry
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

  • System is w10x64
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
AsyncRATAsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
NameDescriptionAttributionBlogpost URLsLink
zgRATzgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat
{"External_config_on_Pastebin": "null", "Server": "fat7ola0077.ddns.net", "Ports": "6666", "Version": "AWS | 3Losh", "Autorun": "false", "Install_Folder": "OUlTdmJkbVltOXNUWmJNSTNaenJBRFRHdW5DVEQ1NUY=", "Install_File": "/EXaE8Iv7YqwUvYpdCam7S2MxkUsp4f6lJ03myXyh6Q2qlSXKYTxmGM1hfEisqclWLa8M3DQpW1Z18oCMdCWvB0O67jIi88Nj9+C60s9nv4=", "AES_key": "9ISvbdmYm9sTZbMI3ZzrADTGunCTD55F", "Mutex": "e6cxv2vqqx5IGT6xHT4NI4U8+Cw/dU3kPjaWP5/Orp4bKr11+1tMVpzyrSwPysP/tXlPw8GYsbvLR82oHuEL+64SA8d7to64YTYd1wyu4i9OLRzsgkWfpanEwxRKF1vx89i3CK1CNbN0cbQhDNNMXo1xv5nze5bVdrps5hujecnBuWXj2mGKGfsw2BXxurBIMSXDoCPTVmpmJ8Nl+ArV/qx6bNPSxdh1sn+BxOzl+jvvey5FSWGxDrwz+5++bOEFPohFc1X5JxFDrXN5UqGuhrWLDGAGMu/uioeZxXz5LaedwpgKjbQLiklx4CE1tNFCLTW3cdMIgrfX3k0Xnw9GKSTx2mx6sHUCJu08LGucoPpJcqYLo8LA74lDmGlRU4IalpcFmpM3zzmZis0JKdoavVPRAUBofxoOZ7cg3xR9La2n7+TYCc2iOoMJu61fLMO963KR3n+YP23UQvldFfVTuie7Y8h9JWMAQnU98bmdhY4B8IBIiqC+niW9LWJ/FtiF6tNIzoOy2EDFCAM3ThiVfMdx5KiutDG0QtRZfZaxoFW+1lUcnVHN6HMU38GJ4mgX+DAqUhXorfR3cI/d7SbwWoXIdJ7qulQopR1q4YoKRrjxtvTY8cR/IuaeAtPXdKMXTGV0pf7A5xdk9nuV/53J2ju8K1BGTOy+MrD5FO4/ZK0=", "Certificate": "false", "ServerSignature": "true", "BDOS": "false", "Startup_Delay": "3", "Group": "null"}
SourceRuleDescriptionAuthorStrings
8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeJoeSecurity_AsyncRATYara detected AsyncRATJoe Security
    8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeJoeSecurity_GenericDownloader_1Yara detected Generic DownloaderJoe Security
      8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeWindows_Trojan_Asyncrat_11a11ba1unknownunknown
      • 0xc880:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn "
      • 0xf038:$a2: Stub.exe
      • 0xf0c8:$a2: Stub.exe
      • 0x9326:$a3: get_ActivatePong
      • 0xca98:$a4: vmware
      • 0xc910:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
      • 0xa22e:$a6: get_SslClient
      8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeINDICATOR_SUSPICIOUS_EXE_ASEP_REG_ReverseDetects file containing reversed ASEP Autorun registry keysditekSHen
      • 0xc912:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
      SourceRuleDescriptionAuthorStrings
      00000000.00000000.1393372389.0000000000A72000.00000002.00000001.01000000.00000003.sdmpJoeSecurity_AsyncRATYara detected AsyncRATJoe Security
        00000000.00000000.1393372389.0000000000A72000.00000002.00000001.01000000.00000003.sdmpINDICATOR_SUSPICIOUS_EXE_ASEP_REG_ReverseDetects file containing reversed ASEP Autorun registry keysditekSHen
        • 0xc712:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
        00000000.00000002.3840255353.0000000007650000.00000004.08000000.00040000.00000000.sdmpJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
          00000000.00000002.3840255353.0000000007650000.00000004.08000000.00040000.00000000.sdmpJoeSecurity_zgRAT_1Yara detected zgRATJoe Security
            00000000.00000002.3840255353.0000000007650000.00000004.08000000.00040000.00000000.sdmpJoeSecurity_BrowserPasswordDump_1Yara detected BrowserPasswordDumpJoe Security
              Click to see the 8 entries
              SourceRuleDescriptionAuthorStrings
              0.0.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.a70000.0.unpackJoeSecurity_AsyncRATYara detected AsyncRATJoe Security
                0.0.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.a70000.0.unpackJoeSecurity_GenericDownloader_1Yara detected Generic DownloaderJoe Security
                  0.0.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.a70000.0.unpackWindows_Trojan_Asyncrat_11a11ba1unknownunknown
                  • 0xc880:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn "
                  • 0xf038:$a2: Stub.exe
                  • 0xf0c8:$a2: Stub.exe
                  • 0x9326:$a3: get_ActivatePong
                  • 0xca98:$a4: vmware
                  • 0xc910:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS
                  • 0xa22e:$a6: get_SslClient
                  0.0.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.a70000.0.unpackINDICATOR_SUSPICIOUS_EXE_ASEP_REG_ReverseDetects file containing reversed ASEP Autorun registry keysditekSHen
                  • 0xc912:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
                  0.2.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.7650000.1.raw.unpackJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
                    Click to see the 9 entries
                    No Sigma rule has matched
                    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                    2024-11-28T14:17:11.781215+010020355951Domain Observed Used for C2 Detected172.93.110.1126666192.168.2.849706TCP
                    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                    2024-11-28T14:17:11.781215+010020356071Domain Observed Used for C2 Detected172.93.110.1126666192.168.2.849706TCP
                    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                    2024-11-28T14:17:11.781215+010028424781Malware Command and Control Activity Detected172.93.110.1126666192.168.2.849706TCP
                    2024-11-28T14:17:34.805738+010028424781Malware Command and Control Activity Detected172.93.110.1126666192.168.2.849710TCP

                    Click to jump to signature section

                    Show All Signature Results

                    AV Detection

                    barindex
                    Source: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeAvira: detected
                    Source: fat7ola0077.ddns.netAvira URL Cloud: Label: malware
                    Source: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeMalware Configuration Extractor: AsyncRAT {"External_config_on_Pastebin": "null", "Server": "fat7ola0077.ddns.net", "Ports": "6666", "Version": "AWS | 3Losh", "Autorun": "false", "Install_Folder": "OUlTdmJkbVltOXNUWmJNSTNaenJBRFRHdW5DVEQ1NUY=", "Install_File": "/EXaE8Iv7YqwUvYpdCam7S2MxkUsp4f6lJ03myXyh6Q2qlSXKYTxmGM1hfEisqclWLa8M3DQpW1Z18oCMdCWvB0O67jIi88Nj9+C60s9nv4=", "AES_key": "9ISvbdmYm9sTZbMI3ZzrADTGunCTD55F", "Mutex": "e6cxv2vqqx5IGT6xHT4NI4U8+Cw/dU3kPjaWP5/Orp4bKr11+1tMVpzyrSwPysP/tXlPw8GYsbvLR82oHuEL+64SA8d7to64YTYd1wyu4i9OLRzsgkWfpanEwxRKF1vx89i3CK1CNbN0cbQhDNNMXo1xv5nze5bVdrps5hujecnBuWXj2mGKGfsw2BXxurBIMSXDoCPTVmpmJ8Nl+ArV/qx6bNPSxdh1sn+BxOzl+jvvey5FSWGxDrwz+5++bOEFPohFc1X5JxFDrXN5UqGuhrWLDGAGMu/uioeZxXz5LaedwpgKjbQLiklx4CE1tNFCLTW3cdMIgrfX3k0Xnw9GKSTx2mx6sHUCJu08LGucoPpJcqYLo8LA74lDmGlRU4IalpcFmpM3zzmZis0JKdoavVPRAUBofxoOZ7cg3xR9La2n7+TYCc2iOoMJu61fLMO963KR3n+YP23UQvldFfVTuie7Y8h9JWMAQnU98bmdhY4B8IBIiqC+niW9LWJ/FtiF6tNIzoOy2EDFCAM3ThiVfMdx5KiutDG0QtRZfZaxoFW+1lUcnVHN6HMU38GJ4mgX+DAqUhXorfR3cI/d7SbwWoXIdJ7qulQopR1q4YoKRrjxtvTY8cR/IuaeAtPXdKMXTGV0pf7A5xdk9nuV/53J2ju8K1BGTOy+MrD5FO4/ZK0=", "Certificate": "false", "ServerSignature": "true", "BDOS": "false", "Startup_Delay": "3", "Group": "null"}
                    Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                    Source: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeJoe Sandbox ML: detected
                    Source: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                    Source: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

                    Networking

                    barindex
                    Source: Network trafficSuricata IDS: 2842478 - Severity 1 - ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s) : 172.93.110.112:6666 -> 192.168.2.8:49706
                    Source: Network trafficSuricata IDS: 2030673 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server) : 172.93.110.112:6666 -> 192.168.2.8:49706
                    Source: Network trafficSuricata IDS: 2035595 - Severity 1 - ET MALWARE Generic AsyncRAT Style SSL Cert : 172.93.110.112:6666 -> 192.168.2.8:49706
                    Source: Network trafficSuricata IDS: 2035607 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server) : 172.93.110.112:6666 -> 192.168.2.8:49706
                    Source: Network trafficSuricata IDS: 2842478 - Severity 1 - ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s) : 172.93.110.112:6666 -> 192.168.2.8:49710
                    Source: Malware configuration extractorURLs: fat7ola0077.ddns.net
                    Source: unknownDNS query: name: fat7ola0077.ddns.net
                    Source: Yara matchFile source: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe, type: SAMPLE
                    Source: Yara matchFile source: 0.0.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.a70000.0.unpack, type: UNPACKEDPE
                    Source: Joe Sandbox ViewASN Name: RELIABLESITEUS RELIABLESITEUS
                    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                    Source: global trafficDNS traffic detected: DNS query: fat7ola0077.ddns.net
                    Source: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe, 00000000.00000002.3839166179.0000000005413000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
                    Source: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe, 00000000.00000002.3839166179.0000000005413000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.0.drString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
                    Source: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe, 00000000.00000002.3838322371.00000000030D1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

                    Key, Mouse, Clipboard, Microphone and Screen Capturing

                    barindex
                    Source: Yara matchFile source: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe, type: SAMPLE
                    Source: Yara matchFile source: 0.0.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.a70000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000000.00000000.1393372389.0000000000A72000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.3838322371.00000000030D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe PID: 7904, type: MEMORYSTR
                    Source: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe, LimeLogger.cs.Net Code: KeyboardLayout

                    System Summary

                    barindex
                    Source: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe, type: SAMPLEMatched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
                    Source: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe, type: SAMPLEMatched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
                    Source: 0.0.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.a70000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
                    Source: 0.0.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.a70000.0.unpack, type: UNPACKEDPEMatched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
                    Source: 0.2.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.7650000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects zgRAT Author: ditekSHen
                    Source: 0.2.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.7650000.1.unpack, type: UNPACKEDPEMatched rule: Detects zgRAT Author: ditekSHen
                    Source: 00000000.00000000.1393372389.0000000000A72000.00000002.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
                    Source: 00000000.00000002.3840255353.0000000007650000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects zgRAT Author: ditekSHen
                    Source: Process Memory Space: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe PID: 7904, type: MEMORYSTRMatched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeCode function: 0_2_010CE5080_2_010CE508
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeCode function: 0_2_0742ED180_2_0742ED18
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeCode function: 0_2_0742CBC80_2_0742CBC8
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeCode function: 0_2_0742B7F00_2_0742B7F0
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeCode function: 0_2_074215590_2_07421559
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeCode function: 0_2_074284500_2_07428450
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeCode function: 0_2_07421CE80_2_07421CE8
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeCode function: 0_2_07421CF80_2_07421CF8
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeCode function: 0_2_0742E2000_2_0742E200
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeCode function: 0_2_0744F0780_2_0744F078
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeCode function: 0_2_074436C80_2_074436C8
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeCode function: 0_2_074436BB0_2_074436BB
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeCode function: 0_2_07441B100_2_07441B10
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeCode function: 0_2_076FB6680_2_076FB668
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeCode function: 0_2_076F1ED00_2_076F1ED0
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeCode function: 0_2_076F75080_2_076F7508
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeCode function: 0_2_076FB65B0_2_076FB65B
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeCode function: 0_2_076F74F80_2_076F74F8
                    Source: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe, 00000000.00000002.3840255353.0000000007650000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameRecovery.dll" vs 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe
                    Source: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe, 00000000.00000000.1393393494.0000000000A82000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameStub.exe" vs 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe
                    Source: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe, 00000000.00000002.3840228354.00000000075B0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameMessagePackLib.dll" vs 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe
                    Source: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe, 00000000.00000002.3839445533.0000000005779000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: OriginalFilenameUNKNOWN_FILET vs 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe
                    Source: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeBinary or memory string: OriginalFilenameStub.exe" vs 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe
                    Source: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                    Source: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe, type: SAMPLEMatched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
                    Source: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe, type: SAMPLEMatched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
                    Source: 0.0.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.a70000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
                    Source: 0.0.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.a70000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
                    Source: 0.2.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.7650000.1.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
                    Source: 0.2.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.7650000.1.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
                    Source: 00000000.00000000.1393372389.0000000000A72000.00000002.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
                    Source: 00000000.00000002.3840255353.0000000007650000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
                    Source: Process Memory Space: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe PID: 7904, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
                    Source: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe, Settings.csBase64 encoded string: 'M89yL6IRDx3prDAG4hnUW9Jjy39r+HLYcTKKqeFmXZjTg4qEjVw79JGo2l+722zluDCWqEVXsGn/U6UijcEjFA==', 'yGwyZf6en3pRn113vEyvvWfq1FkuxzQNVX0kqoX5Q8FL3QWeVQcDalGto4orcMJp+afNDQEcjx3Z1IghI9LM/8qGf6RssyjbL9C204FIuvc=', 'YRdyTF/vaquxesVu04PlVu7qB+A6jI2DpCltWYVvrooLXKSdmyv7jXcIUYrWKv7xTCH/qCLu1a3UETlY7uq5YA==', 'XhHyPmUQQHSz/p1Dhk6usPtYvUuMEzjK0P0ojJNSbS0QibB4kRxIh9QoAACBpKf6uKJvWa4hsF9wBwwuYMvd0g==', '/EXaE8Iv7YqwUvYpdCam7S2MxkUsp4f6lJ03myXyh6Q2qlSXKYTxmGM1hfEisqclWLa8M3DQpW1Z18oCMdCWvB0O67jIi88Nj9+C60s9nv4=', 'TPGO7+Nmmic7ULXXDwIz79cl3sAI1oqQjCZAfJ9NaI+NVzSPKpg0PiCIYR01Tm8oOCboTK68ABgj75sNxEq2iOnyHNLWpui3ORvw8l4xMMyH/aaCvxm8dWaz7fsBVA0QygleP8IECfJjUiEBlVFzWqVLWbTE/GwFugnMc3wYA1XkOYze2B4FJjsh9iOA9F20VRJhmjo8ogzMhYWGLj5js1MD5fapyWU3ZmTRQ086qck/3jcNgcacM45geTSTn0FKyDbLH3BeOWyPWP7/7OT1EVYVcJ6zdEtucc1XRfhz+9kuMWhMItDx3jWbW/B/SnORIw8E6oGN+1pw6PDigkOwcueVRW7SOhUnvLZqXpb976KuIFYHPxUV0RcOWblBUlGvf5HLnzsyqHti+VPQVkNwDC9hOIzE1BzvvN5prDaMKx+2PmyikA1D+qCImVg2yzSfPR0fxGI4Gh2BKg59zU1UK5Zf7HowT+197YN3gWgYwE7nXfaVfP4WRfV4YuqN4QtzSR8ehoHGDrZ87ENlUMZQJ5oj2N7KIj0Fp1GGcvkJ3zVoWiF8zMY0WV+Yd/266b1h8/4JX8KpjWy5ZWQdwq9KylDYC6yjAYao4FsPecP543Aj2wMSunMtdrerRxupy9mKi3rQwHcvRIRBzfJa3/EYR9K5eGLmg7rrFA4dRL3Akwt42H6yld/BlInFjQQD7uLEEk7iiHKI7KOzMkVYc3cpQPKPW2ZtGzDobjh91MzpfwGojThKfxGd16xhQz/G8PMcdBL14yNDkUtNbZxvou0Oe5Rddo2H/Yl2aOI+169AyxO2mfh0lBFg8ssF4dsfL9TPpk0+JxuL4LcnBGq2Yse/0hse9EfLJiOylQ7h+msGr3I//jiua/kvpuRc+i6BsQwYESRa8SNuXrCHzDEZgRLatA7Nw5K9QX8ssdoG4rPeiccfLB2bw3WMCyPSxcRW85w00nQ5VNrUk4NATFSTJdlLMva+MEBEAyzKR8KQwSROzXJHaZ7UmXJoHM4jolRpKC0uE9rorKvL9ojmZc3j5Ldq7XclI4nUbSQi2efGygsD+1BAAvWJ81q3+/+kafrLWEa6qQ+x5IX6RxoUtqZXH6/sdRwADMZcsAFNP0dMpAb6WCfL1L+v3nz/BNyFkTWkVzy+hHhNcJQ7RHvq11NUr71dZBpPZG1A0NPfyrPw48nSOcJmfFQC9uLOobc5IxmbXBQcQJMfBS2g5IXvm7LKI18ggamCH0s+hd6ZveyCyMiMKuENkNRmhSOY2e0qpZFSGxPzoPjZdvVjPXFxgBMVu0RxV+F30QDizBwQRn0QjjbatrXrifNgAJi7kroFTZVye3PtlyDnCr84KAIdz6BCEKvxpcQ0yEN/PlTanvaL49jDmmbBOCXlUH2Ei2R52ddS9u9HaNqHzcmHEOeDC0vbxMuTCIgsT/Eoo1Gc5TTbUGNH4XzDJ4h5KNGyRKkXbBRUyTnrwTIqrg4xHjwbvitQfUZpm83U7pq7u1IGanEWMMhC+D7CdnvA6uQT1X+QQoIataaqCab69gWLGr2X7BwgfIklRACLQKoUv2xnEgFi8jvVrUgnojGJR1i8LCRX5ZN6l6YsHqhfGdZppT8jd+2C2K0ID7gBlDNHGARvBfyUjsFDEAUpdi3hXjsPKX7VGCRW9fDh8kHSCtdVPV585e9FzzFW5XsPFQYEl+uExNvftjksstxyESYYy23u8x4uDV9rn1IUplhQVqgmGmkBCeu2aMHAKV8N9S/a4CvPRWzbcp73APvMbEyJqRxl6tg0kmX1UCKDTwOIgDLBZWkDr1DD7qWow8fKeVgmcL400mlPgaveWFJvl5Okhon6NvvYCichVmACJxhWYvXGtkFJRhHAAYbqhGHly7tBO7bOGBrJ9riuTLnyTLsPYp+WE4i1aNz2FnWjLHwvJcWyuhX3oSdbaHclXadmriBjIOTSRPxKIchuSqqUkq7AwYYLAeOLYN09VsjQ1MwowwEDcXjB5bnclmnnkzfD9NzqCk9om/aXFQEqjJ4/qtFkw+zUGu0P8EiZTSZNnnEf80dxbNbHkd3IEImLPmVq7NK/fEgGSzfQ/mX175viOyHDrON0/NrbIrk763xn/aTS5HwCpQcel9vxwya1l0m8rvhCwO5hXN0mjquOPabTdYDs/Xo7LIcK7RwlisTIA9A0ua6CrxG3vMhg7SHkJvssmEKg/3pJO5QWdW7y8UUu/ixlxAvfv0v/WncZhItqdUEagTj0dCrLe5DhzlNKoed/J5n+kJ0w0Nntg0q4zAnPI5yWCyE42fEN1waSEkK7dnsJkK+njjkZCJAzVrSD2sQgkRgTf5NomFAsgrYiAJw=', 'xVw9GfjGx4gwwWB4a3+Cgu9bNQEPJxonx2r5AoZ62PBUTgado95bY+SqT9zPnX1vBfEqt9x9yLAL7bDO1Lnu2A==', 'vKFx9B/aeasXfgi70RlFpNFu2RoStOzszmebmGZ/cmErLVQ9C7ihAmX
                    Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@1/2@1/1
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeMutant created: NULL
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeMutant created: \Sessions\1\BaseNamedObjects\AsyncMutex_hjNAQsfgh44WR60
                    Source: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                    Source: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: mscoree.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: version.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: mswsock.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: dnsapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: iphlpapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: rasadhlp.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: fwpuclnt.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: secur32.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: schannel.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: mskeyprotect.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: ntasn1.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: ncrypt.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: ncryptsslp.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: gpapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: cryptnet.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: winnsi.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: winhttp.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: dhcpcsvc6.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: dhcpcsvc.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: webio.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: cabinet.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: wbemcomn.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: amsi.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32Jump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                    Source: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                    Source: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

                    Data Obfuscation

                    barindex
                    Source: 0.2.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.7650000.1.raw.unpack, EwV3ECxYhIse1SOarW.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
                    Source: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe, Packet.cs.Net Code: Plugins System.AppDomain.Load(byte[])
                    Source: 0.2.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.7650000.1.raw.unpack, AssemblyLoader.cs.Net Code: ReadFromEmbeddedResources System.Reflection.Assembly.Load(byte[])
                    Source: Yara matchFile source: 0.2.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.7650000.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.7650000.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000000.00000002.3840255353.0000000007650000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.3838322371.00000000030D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe PID: 7904, type: MEMORYSTR
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeCode function: 0_2_0742D4D0 pushfd ; iretd 0_2_0742D789
                    Source: 0.2.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.7650000.1.raw.unpack, EwV3ECxYhIse1SOarW.csHigh entropy of concatenated method names: 'BPTavEfPI8', 'uVaa4GpUIk', 'u6YaUGQ5Rc', 't0UaRBG3Pj', 'pNJaQb5F9t', 'YcBaEMIBPc', 'fjRVlvZgqSN', 'nWN5m7K3Q', 'ReZxSxiJZ', 'kJmawSxbE'
                    Source: 0.2.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.7650000.1.raw.unpack, OBqe2IUAeSpOmlOQ4O.csHigh entropy of concatenated method names: 'nOQdl4ODOg', 'tY3dXGtH5f', 'q9qdvQao7g', 'DpYddoq5nS', 'vUcduRRnlL', 'sqedUSL72O', 'MNddRugcTR', 'd6IBJRRp2Z', 'c8idQhNv3S', 'V1kdEyl02V'

                    Boot Survival

                    barindex
                    Source: Yara matchFile source: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe, type: SAMPLE
                    Source: Yara matchFile source: 0.0.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.a70000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000000.00000000.1393372389.0000000000A72000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.3838322371.00000000030D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe PID: 7904, type: MEMORYSTR
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeKey value created or modified: HKEY_CURRENT_USER\SOFTWARE\893915391951F2ADC506 D063CCCDE10825690EE61BD75AEF3E9E0A6C0EDE83CD39A20F0876E45632F565Jump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                    Malware Analysis System Evasion

                    barindex
                    Source: Yara matchFile source: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe, type: SAMPLE
                    Source: Yara matchFile source: 0.0.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.a70000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000000.00000000.1393372389.0000000000A72000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.3838322371.00000000030D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe PID: 7904, type: MEMORYSTR
                    Source: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeBinary or memory string: SBIEDLL.DLL
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeMemory allocated: 10C0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeMemory allocated: 30D0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeMemory allocated: 2D30000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeWindow / User API: threadDelayed 9091Jump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeWindow / User API: threadDelayed 760Jump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe TID: 8032Thread sleep time: -30000s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe TID: 8064Thread sleep time: -6456360425798339s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe TID: 8072Thread sleep count: 9091 > 30Jump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe TID: 8072Thread sleep count: 760 > 30Jump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe, 00000000.00000002.3839166179.0000000005413000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWx
                    Source: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeBinary or memory string: vmware
                    Source: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe, 00000000.00000002.3839166179.0000000005413000.00000004.00000020.00020000.00000000.sdmp, 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe, 00000000.00000002.3839386628.0000000005501000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess information queried: ProcessInformationJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeProcess token adjusted: DebugJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeMemory allocated: page read and write | page guardJump to behavior

                    HIPS / PFW / Operating System Protection Evasion

                    barindex
                    Source: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe, LimeLogger.csReference to suspicious API methods: MapVirtualKey(vkCode, 0u)
                    Source: 0.2.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.7650000.1.raw.unpack, FFDecryptor.csReference to suspicious API methods: LoadLibrary(AmuCetVm3vMiSk7FV8gP.co6V6ElXHqL(text, "mozglue.dll", AmuCetVm3vMiSk7FV8gP.f3BVmSYRirG))
                    Source: 0.2.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.7650000.1.raw.unpack, FFDecryptor.csReference to suspicious API methods: ((DLLFunctionDelegate)vhIA9tVOZoLB1ZN4qxmk.co6V6ElXHqL(GetProcAddress(NSS3, "NSS_Init"), gJ2NVkVmKVK4FEvqyevw.co6V6ElXHqL(typeof(DLLFunctionDelegate).TypeHandle, gJ2NVkVmKVK4FEvqyevw.c0lVmfJ6T2d), vhIA9tVOZoLB1ZN4qxmk.j9HVOsyVlbd))(configdir)
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeQueries volume information: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                    Lowering of HIPS / PFW / Operating System Security Settings

                    barindex
                    Source: Yara matchFile source: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe, type: SAMPLE
                    Source: Yara matchFile source: 0.0.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.a70000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000000.00000000.1393372389.0000000000A72000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.3838322371.00000000030D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe PID: 7904, type: MEMORYSTR
                    Source: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe, 00000000.00000002.3839166179.0000000005413000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

                    Stealing of Sensitive Information

                    barindex
                    Source: Yara matchFile source: 0.2.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.7650000.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.7650000.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000000.00000002.3840255353.0000000007650000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe PID: 7904, type: MEMORYSTR
                    Source: Yara matchFile source: 0.2.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.7650000.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.7650000.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000000.00000002.3840255353.0000000007650000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0.2.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.7650000.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.7650000.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000000.00000002.3840255353.0000000007650000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqliteJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                    Source: C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior

                    Remote Access Functionality

                    barindex
                    Source: Yara matchFile source: 0.2.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.7650000.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.7650000.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000000.00000002.3840255353.0000000007650000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe PID: 7904, type: MEMORYSTR
                    Source: Yara matchFile source: 0.2.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.7650000.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.7650000.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000000.00000002.3840255353.0000000007650000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0.2.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.7650000.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe.7650000.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000000.00000002.3840255353.0000000007650000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                    Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
                    Windows Management Instrumentation
                    1
                    Scheduled Task/Job
                    1
                    Scheduled Task/Job
                    1
                    Modify Registry
                    1
                    OS Credential Dumping
                    1
                    Query Registry
                    Remote Services1
                    Input Capture
                    1
                    Encrypted Channel
                    Exfiltration Over Other Network MediumAbuse Accessibility Features
                    CredentialsDomainsDefault Accounts1
                    Scheduled Task/Job
                    1
                    DLL Side-Loading
                    1
                    DLL Side-Loading
                    1
                    Disable or Modify Tools
                    1
                    Input Capture
                    121
                    Security Software Discovery
                    Remote Desktop Protocol1
                    Archive Collected Data
                    1
                    Non-Application Layer Protocol
                    Exfiltration Over BluetoothNetwork Denial of Service
                    Email AddressesDNS ServerDomain Accounts1
                    Native API
                    Logon Script (Windows)Logon Script (Windows)31
                    Virtualization/Sandbox Evasion
                    Security Account Manager1
                    Process Discovery
                    SMB/Windows Admin Shares1
                    Data from Local System
                    21
                    Application Layer Protocol
                    Automated ExfiltrationData Encrypted for Impact
                    Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook111
                    Obfuscated Files or Information
                    NTDS31
                    Virtualization/Sandbox Evasion
                    Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
                    Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script2
                    Software Packing
                    LSA Secrets1
                    Application Window Discovery
                    SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                    Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
                    DLL Side-Loading
                    Cached Domain Credentials13
                    System Information Discovery
                    VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                    Hide Legend

                    Legend:

                    • Process
                    • Signature
                    • Created File
                    • DNS/IP Info
                    • Is Dropped
                    • Is Windows Process
                    • Number of created Registry Values
                    • Number of created Files
                    • Visual Basic
                    • Delphi
                    • Java
                    • .Net C# or VB.NET
                    • C, C++ or other language
                    • Is malicious
                    • Internet

                    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                    windows-stand
                    SourceDetectionScannerLabelLink
                    8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe100%AviraTR/Dropper.Gen
                    8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe100%Joe Sandbox ML
                    No Antivirus matches
                    No Antivirus matches
                    No Antivirus matches
                    SourceDetectionScannerLabelLink
                    fat7ola0077.ddns.net100%Avira URL Cloudmalware
                    NameIPActiveMaliciousAntivirus DetectionReputation
                    bg.microsoft.map.fastly.net
                    199.232.214.172
                    truefalse
                      high
                      fat7ola0077.ddns.net
                      172.93.110.112
                      truetrue
                        unknown
                        NameMaliciousAntivirus DetectionReputation
                        fat7ola0077.ddns.nettrue
                        • Avira URL Cloud: malware
                        unknown
                        NameSourceMaliciousAntivirus DetectionReputation
                        http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe, 00000000.00000002.3838322371.00000000030D1000.00000004.00000800.00020000.00000000.sdmpfalse
                          high
                          • No. of IPs < 25%
                          • 25% < No. of IPs < 50%
                          • 50% < No. of IPs < 75%
                          • 75% < No. of IPs
                          IPDomainCountryFlagASNASN NameMalicious
                          172.93.110.112
                          fat7ola0077.ddns.netUnited States
                          23470RELIABLESITEUStrue
                          Joe Sandbox version:41.0.0 Charoite
                          Analysis ID:1564558
                          Start date and time:2024-11-28 14:16:11 +01:00
                          Joe Sandbox product:CloudBasic
                          Overall analysis duration:0h 6m 36s
                          Hypervisor based Inspection enabled:false
                          Report type:full
                          Cookbook file name:default.jbs
                          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                          Number of analysed new started processes analysed:6
                          Number of new started drivers analysed:0
                          Number of existing processes analysed:0
                          Number of existing drivers analysed:0
                          Number of injected processes analysed:0
                          Technologies:
                          • HCA enabled
                          • EGA enabled
                          • AMSI enabled
                          Analysis Mode:default
                          Analysis stop reason:Timeout
                          Sample name:8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe
                          Detection:MAL
                          Classification:mal100.troj.spyw.evad.winEXE@1/2@1/1
                          EGA Information:
                          • Successful, ratio: 100%
                          HCA Information:
                          • Successful, ratio: 99%
                          • Number of executed functions: 211
                          • Number of non-executed functions: 11
                          Cookbook Comments:
                          • Found application associated with file extension: .exe
                          • Override analysis time to 240000 for current running targets taking high CPU consumption
                          • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                          • Excluded IPs from analysis (whitelisted): 199.232.214.172
                          • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
                          • Not all processes where analyzed, report is missing behavior information
                          • Report size getting too big, too many NtOpenKeyEx calls found.
                          • Report size getting too big, too many NtQueryValueKey calls found.
                          • Report size getting too big, too many NtReadVirtualMemory calls found.
                          • VT rate limit hit for: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe
                          TimeTypeDescription
                          08:17:13API Interceptor8946669x Sleep call for process: 8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe modified
                          No context
                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                          bg.microsoft.map.fastly.netFVR-N2411-07396.exeGet hashmaliciousLokibot, PureLog StealerBrowse
                          • 199.232.210.172
                          5c13e6.msiGet hashmaliciousAteraAgentBrowse
                          • 199.232.214.172
                          FACTURE NON PAYEE.pdfGet hashmaliciousUnknownBrowse
                          • 199.232.210.172
                          goHB2EXlPf.exeGet hashmaliciousRedLine, SectopRATBrowse
                          • 199.232.210.172
                          goHB2EXlPf.exeGet hashmaliciousRedLine, SectopRATBrowse
                          • 199.232.210.172
                          9VbeqQbgU4.exeGet hashmaliciousRedLine, SectopRATBrowse
                          • 199.232.210.172
                          chutmarao.ps1Get hashmaliciousRHADAMANTHYSBrowse
                          • 199.232.210.172
                          fpPn4XBjyk.exeGet hashmaliciousRHADAMANTHYSBrowse
                          • 199.232.210.172
                          Banco Santander Totta - NOTIFICA#U00c7#U00c3O DE TRANSFER#U00caNCIA ELECTR#U00d3NICA.emlGet hashmaliciousCredentialStealerBrowse
                          • 199.232.214.172
                          invoice-1664809283.pdfGet hashmaliciousUnknownBrowse
                          • 199.232.214.172
                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                          RELIABLESITEUShttps://trimmer.to:443/GWHMYGet hashmaliciousHTMLPhisherBrowse
                          • 104.194.8.184
                          ickTGSF56D.exeGet hashmaliciousUnknownBrowse
                          • 141.98.153.205
                          Image_Product_Inquiry_Request_Villoslada.exeGet hashmaliciousRemcos, GuLoaderBrowse
                          • 185.150.191.117
                          Payload 94.75 (2).225.exeGet hashmaliciousUnknownBrowse
                          • 172.93.106.189
                          SecureMessageATT.htmlGet hashmaliciousHTMLPhisherBrowse
                          • 104.194.8.184
                          Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                          • 104.243.33.38
                          http://holidaybunch.comGet hashmaliciousUnknownBrowse
                          • 104.194.8.184
                          SecuriteInfo.com.BScope.Trojan.Agentb.20481.11202.msiGet hashmaliciousUnknownBrowse
                          • 103.195.103.66
                          Priority_Quote_Request_Items_List.exeGet hashmaliciousRemcosBrowse
                          • 185.150.191.117
                          ppc.elfGet hashmaliciousMiraiBrowse
                          • 154.16.151.108
                          No context
                          No context
                          Process:C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe
                          File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
                          Category:dropped
                          Size (bytes):71954
                          Entropy (8bit):7.996617769952133
                          Encrypted:true
                          SSDEEP:1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
                          MD5:49AEBF8CBD62D92AC215B2923FB1B9F5
                          SHA1:1723BE06719828DDA65AD804298D0431F6AFF976
                          SHA-256:B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
                          SHA-512:BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
                          Malicious:false
                          Reputation:high, very likely benign file
                          Preview:MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..*Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=*....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.|.c.&>?..^t. ..;..X.d.E.0G....[Q.*,*......#.Dp..L.o|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...
                          Process:C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe
                          File Type:data
                          Category:dropped
                          Size (bytes):328
                          Entropy (8bit):3.247897867253902
                          Encrypted:false
                          SSDEEP:6:kKlcL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:9ciDImsLNkPlE99SNxAhUe/3
                          MD5:65CB97558E1964675AA29B6610BF96BE
                          SHA1:63E206648A432B3CF3349475D5219A39BDC8933A
                          SHA-256:08575F0CA4BF4A99E114E3A0F8796924A0093E5CAFEA52D17D52F906E444EA79
                          SHA-512:5171B529F794FB411129BD726E50612CA88233FAF4A2CDB0527B7F207F42A69C1A1271D97E9AA172B5EF41D7A7D6D28319878A105E87FD3779C86BE00BBDFC8C
                          Malicious:false
                          Reputation:low
                          Preview:p...... .........<..A..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...
                          File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                          Entropy (8bit):5.436293215566185
                          TrID:
                          • Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                          • Win32 Executable (generic) a (10002005/4) 49.75%
                          • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                          • Windows Screen Saver (13104/52) 0.07%
                          • Generic Win/DOS Executable (2004/3) 0.01%
                          File name:8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe
                          File size:63'488 bytes
                          MD5:bd29364f916d0e1bba479e785773e00e
                          SHA1:7f6a2fee536af37dcfbd46d316c061ba63bc7fd7
                          SHA256:95061805157fafa10b3587bb9a2aae6e149e5ac7c7829f648ad8a988d78efe59
                          SHA512:fab05760d9541c6288a9cd151b739a63bf28c44f94fb2bf6af106226dbb5d97019c4ba75fa79752df8e5c5a468360e686a5164be154ac1216ea930709b3d97bc
                          SSDEEP:1536:K206UX9kGYrsVqfhuD2a/d97IURE8vU6axDKbpAg6MuLdWAR88rBTR5x:K206UX9kSE8vU6axDKbpRVuBWuJTx
                          TLSH:6153F8053BE8C126F2BE8F7468F6768446B5F56F2902D91D1C89119B0632BC29D42EFF
                          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...]x^e............................~.... ... ....@.. .......................`............`................................
                          Icon Hash:00928e8e8686b000
                          Entrypoint:0x410a7e
                          Entrypoint Section:.text
                          Digitally signed:false
                          Imagebase:0x400000
                          Subsystem:windows gui
                          Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                          DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                          Time Stamp:0x655E785D [Wed Nov 22 21:53:33 2023 UTC]
                          TLS Callbacks:
                          CLR (.Net) Version:
                          OS Version Major:4
                          OS Version Minor:0
                          File Version Major:4
                          File Version Minor:0
                          Subsystem Version Major:4
                          Subsystem Version Minor:0
                          Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744
                          Instruction
                          jmp dword ptr [00402000h]
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          add byte ptr [eax], al
                          NameVirtual AddressVirtual Size Is in Section
                          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                          IMAGE_DIRECTORY_ENTRY_IMPORT0x10a280x53.text
                          IMAGE_DIRECTORY_ENTRY_RESOURCE0x120000x7ff.rsrc
                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                          IMAGE_DIRECTORY_ENTRY_BASERELOC0x140000xc.reloc
                          IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                          IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                          IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
                          NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                          .text0x20000xea840xec00863c02b8dea76417a660d5ca38aad1f7False0.4705707097457627data5.4749892384672325IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                          .rsrc0x120000x7ff0x80033cdbc5c50f34a35b4f0e61582ac7f11False0.41650390625data4.884866150337139IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                          .reloc0x140000xc0x2007d92babacd1252c99b71c04e7b7bb767False0.044921875data0.08153941234324169IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
                          NameRVASizeTypeLanguageCountryZLIB Complexity
                          RT_VERSION0x120a00x2ccdata0.43575418994413406
                          RT_MANIFEST0x1236c0x493exported SGML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators0.43381725021349277
                          DLLImport
                          mscoree.dll_CorExeMain
                          TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                          2024-11-28T14:17:11.781215+01002842478ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)1172.93.110.1126666192.168.2.849706TCP
                          2024-11-28T14:17:11.781215+01002030673ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)1172.93.110.1126666192.168.2.849706TCP
                          2024-11-28T14:17:11.781215+01002035595ET MALWARE Generic AsyncRAT Style SSL Cert1172.93.110.1126666192.168.2.849706TCP
                          2024-11-28T14:17:11.781215+01002035607ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)1172.93.110.1126666192.168.2.849706TCP
                          2024-11-28T14:17:34.805738+01002842478ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)1172.93.110.1126666192.168.2.849710TCP
                          TimestampSource PortDest PortSource IPDest IP
                          Nov 28, 2024 14:17:10.335477114 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:10.455643892 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:10.455763102 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:10.520138979 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:10.640218019 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:11.655913115 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:11.655930996 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:11.656042099 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:11.661211014 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:11.781214952 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:12.016509056 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:12.060483932 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:14.122442961 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:14.246359110 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:14.246443033 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:14.366441011 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:15.300261021 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:15.341695070 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:15.501045942 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:15.511907101 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:15.633745909 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:15.633816957 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:15.753854036 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:21.467771053 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:21.588093042 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:21.588211060 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:21.709623098 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:21.949398041 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:21.997910023 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:22.149302006 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:22.195542097 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:22.315751076 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:22.315864086 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:22.436100006 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:23.750063896 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:23.794739962 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:23.951188087 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:23.997869968 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:28.826823950 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:28.946944952 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:28.947052002 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:29.067385912 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:29.339852095 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:29.388443947 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:29.553409100 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:29.555234909 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:29.675288916 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:29.675354004 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:29.796046972 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:30.299808979 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:30.341728926 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:30.505459070 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:30.509329081 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:30.635756969 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:30.635900974 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:30.755894899 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.225810051 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.226130962 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.226216078 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.226300955 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.231055975 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.231137991 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.231157064 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.239456892 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.239501953 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.239538908 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.247852087 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.247910023 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.247950077 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.256228924 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.256284952 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.256330967 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.264642000 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.264702082 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.264765978 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.273075104 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.273133993 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.273183107 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.281486988 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.281549931 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.445029974 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.445111036 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.445159912 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.448651075 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.448792934 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.448848009 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.456342936 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.459140062 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.459183931 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.459223986 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.466953039 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.467000961 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.467048883 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.474536896 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.474591970 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.474620104 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.482239962 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.482291937 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.482331991 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.489880085 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.489902973 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.489948988 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.497575045 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.497653008 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.497833014 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.505215883 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.505294085 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.505316973 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.512958050 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.513036966 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.513062000 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.520617962 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.520715952 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.520725012 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.528290987 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.528345108 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.528376102 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.535969019 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.536081076 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.536155939 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.543684959 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.543787956 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.646296024 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.646328926 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.646423101 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.649321079 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.649430990 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.649491072 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.655527115 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.655635118 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.655687094 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.661758900 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.661879063 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.661927938 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.667686939 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.667793036 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.667844057 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.673672915 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.673757076 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.673813105 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.679317951 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.679425001 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.679471016 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.684853077 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.684942007 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.685002089 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.690335035 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.690371037 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.690426111 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.695800066 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.695914030 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.695990086 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.701227903 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.701329947 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.701385021 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.706716061 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.706885099 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.706943989 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.712245941 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.712387085 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.712440014 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.717813015 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.717915058 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.717984915 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.723155022 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.723309994 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.723366976 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.728637934 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.728844881 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.728898048 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.734225035 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.734237909 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.734277010 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.739600897 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.739689112 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.739744902 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.745053053 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.745152950 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.745204926 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.750508070 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.750633955 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.750686884 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.766391039 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.766516924 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.766614914 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.769424915 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.769527912 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.769588947 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.775783062 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.775849104 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.775899887 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.781833887 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.781950951 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.782010078 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.789041996 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.789094925 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.789201975 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.847553015 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.847697020 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.847774982 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.849577904 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.849618912 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.849684954 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.853749990 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.853812933 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.853894949 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.857953072 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.858047962 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.858108997 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.861984015 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.862070084 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.862138033 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.866034031 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.866134882 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.866245031 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.869967937 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.870081902 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.870145082 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.873763084 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.873867989 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.873965979 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.877485037 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.877597094 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.877674103 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.881191015 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.881314993 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.881381989 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.884833097 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.884916067 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.884987116 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.888521910 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.888580084 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.888633013 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.892040014 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.892147064 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.892205000 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.895736933 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.895823956 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.895895004 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.897793055 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.897883892 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.897941113 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.899876118 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.899969101 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.900026083 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.901978970 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.902082920 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.902149916 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.904074907 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.904166937 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.904263973 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.906160116 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.906272888 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.906332016 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.909174919 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.909255981 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.909311056 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.967775106 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.967854023 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.967905045 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.969598055 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.969713926 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.969820023 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.973798037 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.973927975 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.973978043 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.978167057 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.978220940 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.978260994 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.982111931 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.982223034 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.982263088 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.986215115 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.986274004 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.986337900 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.990533113 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.990545988 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.990592957 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.993938923 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.994035959 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.994075060 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:31.997564077 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.997678995 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:31.997725964 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.001349926 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.001467943 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.001518965 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.004910946 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.005008936 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.005048037 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.008559942 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.008649111 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.008697987 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.012110949 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.012204885 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.012243032 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.016019106 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.016146898 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.016271114 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.017851114 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.017957926 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.018001080 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.019925117 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.020009995 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.020061016 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.022124052 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.022135973 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.022171021 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.024174929 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.024266005 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.024343014 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.026213884 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.026309967 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.026362896 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.048871994 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.049001932 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.049057961 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.049870968 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.050004959 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.050046921 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.088088036 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.088186026 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.088248968 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.089735031 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.089863062 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.089917898 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.093946934 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.094047070 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.094093084 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.098283052 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.098304987 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.098474026 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.102226973 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.102314949 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.102368116 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.106271029 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.106391907 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.106446028 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.110701084 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.110804081 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.110879898 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.114016056 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.114125967 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.114183903 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.117793083 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.117870092 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.117929935 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.121524096 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.121562004 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.121611118 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.124964952 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.125065088 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.125108957 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.128634930 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.128750086 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.128922939 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.132132053 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.132249117 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.132302046 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.136431932 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.136495113 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.136543989 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.137901068 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.138031006 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.138079882 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.139992952 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.140110016 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.140153885 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.142040968 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.142132044 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.142179012 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.144264936 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.144350052 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.144393921 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.168966055 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.169131994 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.169212103 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.170017004 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.170100927 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.170150042 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.208251953 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.208348036 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.208415031 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.209842920 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.210019112 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.210077047 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.214040041 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.214143038 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.214184999 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.218480110 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.218674898 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.218728065 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.222431898 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.222599030 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.222652912 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.226402044 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.226541996 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.226594925 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.230851889 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.231101990 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.231157064 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.234144926 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.234206915 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.234256983 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.237893105 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.237953901 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.238006115 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.241692066 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.241795063 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.241878986 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.245121002 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.245168924 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.245291948 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.248955011 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.249057055 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.249106884 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.251095057 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.251200914 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.251252890 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.252229929 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.252326965 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.252383947 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.256513119 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.256644011 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.256695986 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.258152008 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.258269072 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.258313894 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.260175943 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.260256052 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.260304928 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.262142897 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.262244940 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.262294054 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.264456034 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.264497995 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.264547110 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.289169073 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.289274931 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.289347887 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.290132046 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.328567028 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.328711987 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.328715086 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.330064058 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.330140114 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.330176115 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.334122896 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.334192991 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.334228992 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.338675022 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.338752031 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.338789940 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.342609882 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.342672110 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.342710018 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.346497059 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.346560955 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.346600056 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.351052999 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.351154089 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.351183891 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.354151011 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.354219913 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.354271889 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.357904911 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.357984066 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.358007908 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.361807108 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.361865044 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.361911058 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.365200996 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.365255117 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.365318060 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.369083881 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.369167089 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.369194984 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.371274948 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.371324062 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.371429920 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.372287035 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.372340918 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.372373104 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.376794100 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.376880884 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.376919985 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.378187895 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.378238916 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.378319979 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.380405903 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.380448103 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.380465984 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.382210970 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.382266045 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.382289886 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.384442091 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.384495974 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.384560108 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.409332991 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.409420013 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.409425974 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.448683977 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.448806047 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.448950052 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.450012922 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.450098038 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.450125933 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.454125881 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.454176903 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.454211950 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.458826065 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.458910942 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.458931923 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.463325024 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.463385105 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.463550091 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.466984034 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.467045069 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.467052937 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.471457958 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.471543074 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.471668959 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.474181890 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.474241972 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.474358082 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.478252888 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.478318930 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.478341103 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.482275963 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.482351065 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.482356071 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.485538960 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.485596895 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.485661030 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.489978075 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.490034103 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.490048885 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.492037058 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.492098093 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.492127895 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.493067026 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.493139982 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.493222952 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.497092009 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.497143030 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.497152090 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.499679089 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.499737978 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.499768972 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.504309893 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.504375935 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.504406929 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.508960962 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.509030104 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.509068966 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.513572931 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.513638973 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.513662100 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.529443979 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.529506922 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.529521942 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.568957090 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.569042921 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.569051027 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.571335077 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.571388960 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.571422100 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.575901985 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.575980902 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.576010942 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.580523968 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.580600023 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.580665112 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.585190058 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.585242033 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.585244894 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.589764118 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.589828014 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.589855909 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.594384909 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.594470024 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.594477892 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.598992109 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.599056005 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.599087954 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.603684902 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.603738070 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.603765011 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.608335972 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.608380079 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.608409882 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.612867117 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.612920046 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.612951040 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.617500067 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.617547989 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.617583990 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.622129917 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.622174025 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.622235060 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.626743078 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.626851082 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.626930952 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.631370068 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.631489992 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.631496906 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.636018991 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.636082888 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.636087894 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:32.640568972 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:32.640660048 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:33.363065958 CET497106666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:33.364025116 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:33.483139038 CET666649710172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:33.483238935 CET497106666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:33.483935118 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:33.483992100 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:33.486540079 CET497106666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:33.606535912 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:33.608935118 CET666649710172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:34.679135084 CET666649710172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:34.685715914 CET497106666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:34.805737972 CET666649710172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:34.807373047 CET497106666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:34.930253983 CET666649710172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:35.167026043 CET666649710172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:35.169478893 CET497106666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:36.292032957 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:36.413583040 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:36.413646936 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:36.533634901 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:36.772943974 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:36.825894117 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:36.975013971 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:36.977252960 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:37.097354889 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:37.097420931 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:37.217526913 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:43.638933897 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:43.831638098 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:43.831780910 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:43.951781034 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:44.191952944 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:44.232176065 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:44.393220901 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:44.395214081 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:44.516212940 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:44.516299009 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:44.636367083 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:50.998400927 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:51.118766069 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:51.118834019 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:51.238809109 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:51.478598118 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:51.528918982 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:51.679769993 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:51.681804895 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:51.801820040 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:51.801907063 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:51.921936989 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:53.747001886 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:53.809393883 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:53.952317953 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:54.001688004 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:58.357528925 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:58.477560997 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:58.477613926 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:58.597755909 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:58.832375050 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:58.888247013 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:59.033418894 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:59.035134077 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:59.155662060 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:17:59.155755997 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:17:59.275854111 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:05.716912985 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:05.836869955 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:05.836996078 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:05.956891060 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:06.196024895 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:06.247606993 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:06.397903919 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:06.400775909 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:06.521456003 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:06.521696091 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:06.641935110 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:13.076282978 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:13.196306944 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:13.196393013 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:13.320516109 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:13.560039043 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:13.606898069 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:13.762969971 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:13.765096903 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:13.889703989 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:13.889915943 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:14.010539055 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:19.091537952 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:19.218054056 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:19.219044924 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:19.339140892 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:19.577843904 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:19.622462988 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:19.778867960 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:19.780631065 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:19.902049065 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:19.903882980 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:20.023963928 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:22.343512058 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:22.463537931 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:22.465015888 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:22.585840940 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:22.824734926 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:22.872428894 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:23.025856972 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:23.027348995 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:23.154066086 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:23.154141903 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:23.274070978 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:23.762425900 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:23.809923887 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:23.963648081 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:24.013055086 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:29.700824022 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:29.820704937 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:29.820998907 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:29.940984011 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:30.180540085 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:30.231765032 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:30.381383896 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:30.383269072 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:30.503453016 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:30.504899979 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:30.626897097 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:31.482172012 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:31.604167938 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:31.604260921 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:31.724909067 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:31.963854074 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:32.014904976 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:32.164958954 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:32.166950941 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:32.293790102 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:32.293905973 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:32.413979053 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:33.466450930 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:33.589744091 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:33.590023994 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:33.710021973 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:33.954284906 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:33.998775959 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:34.149964094 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:34.157627106 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:34.278214931 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:34.279171944 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:34.399143934 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:37.388487101 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:37.512892008 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:37.513027906 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:37.639806986 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:37.880927086 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:37.934847116 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:38.082272053 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:38.084515095 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:38.205284119 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:38.205615997 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:38.330657005 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:44.747848988 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:44.867948055 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:44.868010998 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:44.989986897 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:45.229809999 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:45.278613091 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:45.431147099 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:45.432699919 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:45.552719116 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:45.552808046 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:45.674443960 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:50.263351917 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:50.383531094 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:50.384799957 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:50.504775047 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:50.743324995 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:50.794111013 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:50.944542885 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:50.947062016 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:51.067744970 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:51.067809105 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:51.187906981 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:53.766258955 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:53.812728882 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:53.965424061 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:54.014769077 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:57.622714996 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:57.742743015 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:57.747189999 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:57.867273092 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:58.106739044 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:58.153451920 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:58.307854891 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:58.311640978 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:58.431700945 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:18:58.431818962 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:18:58.551911116 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:01.529453993 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:01.649725914 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:01.652726889 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:01.778808117 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:02.016571045 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:02.059695959 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:02.218909979 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:02.222127914 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:02.342133999 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:02.342211962 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:02.465991974 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:08.888305902 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:09.008366108 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:09.008430958 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:09.128818989 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:09.366558075 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:09.434640884 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:09.567787886 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:09.622133970 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:09.938724041 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:10.059617996 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:10.059715986 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:10.179718018 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:11.201343060 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:11.321567059 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:11.321644068 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:11.441669941 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:11.679987907 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:11.731504917 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:11.881536007 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:11.883503914 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:12.003716946 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:12.003767014 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:12.124140978 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:18.560709953 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:18.682082891 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:18.687422991 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:18.811662912 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:19.050740957 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:19.231492996 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:19.252087116 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:19.254017115 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:19.374166965 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:19.374362946 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:19.495735884 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:23.764132023 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:23.840795040 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:23.965253115 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:24.043942928 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:25.216519117 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:25.336699963 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:25.336846113 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:25.456823111 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:25.695583105 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:25.840794086 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:25.899868011 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:25.901607990 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:26.024250031 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:26.024308920 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:26.144700050 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:32.575747967 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:32.695863008 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:32.696181059 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:32.817190886 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:33.056279898 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:33.139112949 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:33.257368088 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:33.259854078 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:33.380208969 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:33.380333900 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:33.500447989 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:39.935368061 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:40.062235117 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:40.062299967 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:40.182295084 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:40.421919107 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:40.543823004 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:40.623028040 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:40.625477076 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:40.747785091 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:40.747865915 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:40.868153095 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:44.626293898 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:44.747594118 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:44.747642994 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:44.869308949 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:45.108196020 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:45.309493065 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:45.309561968 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:45.311243057 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:45.431190014 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:45.431274891 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:45.551471949 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:46.732098103 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:46.856015921 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:46.856084108 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:46.979116917 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:47.218341112 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:47.346316099 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:47.419097900 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:47.423386097 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:47.543329954 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:47.543395042 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:47.663548946 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:53.779149055 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:53.840615034 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:53.978579998 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:54.043843031 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:54.091042995 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:54.284120083 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:54.284183025 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:54.406193018 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:54.643466949 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:54.842437983 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:54.844563961 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:54.856569052 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:54.978530884 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:19:54.986884117 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:19:55.107048988 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:00.638247013 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:00.758441925 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:00.764323950 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:00.884773016 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:01.123608112 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:01.234386921 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:01.325212002 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:01.331788063 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:01.451790094 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:01.451899052 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:01.578850031 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:07.997443914 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:08.118233919 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:08.118279934 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:08.238481998 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:08.478884935 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:08.528194904 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:08.680042982 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:08.682082891 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:08.802215099 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:08.804446936 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:08.924952984 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:15.356587887 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:15.476761103 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:15.477015972 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:15.598726988 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:15.837946892 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:15.887379885 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:16.039021969 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:16.041198015 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:16.163011074 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:16.163060904 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:16.284137011 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:16.622243881 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:16.742343903 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:16.742444992 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:16.862502098 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:17.096913099 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:17.137404919 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:17.298105001 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:17.299981117 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:17.420126915 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:17.420351982 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:17.541311026 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:17.888130903 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:18.008241892 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:18.008301973 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:18.128535032 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:18.366995096 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:18.418618917 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:18.568067074 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:18.569578886 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:18.689636946 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:18.689815044 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:18.810278893 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:22.951214075 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:23.071269989 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:23.076288939 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:23.196491957 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:23.435286045 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:23.481113911 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:23.636667967 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:23.646816969 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:23.768244028 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:23.768400908 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:23.837610006 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:23.887356997 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:23.891535997 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:23.969492912 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:24.012500048 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:27.497251987 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:27.618448973 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:27.622313023 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:27.742296934 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:27.980966091 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:28.027946949 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:28.182063103 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:28.183968067 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:28.305414915 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:28.305469036 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:28.425379038 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:33.497071028 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:33.617177010 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:33.617244959 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:33.743174076 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:33.981301069 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:34.027925968 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:34.182429075 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:34.184834957 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:34.304908037 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:34.304975033 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:34.425036907 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:40.860095024 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:40.980447054 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:40.988102913 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:41.108263969 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:41.347954035 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:41.387347937 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:41.550046921 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:41.555603027 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:41.676599026 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:41.676678896 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:41.797569990 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:48.215940952 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:48.335983038 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:48.336080074 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:48.456181049 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:48.762729883 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:48.809087992 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:48.964087963 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:48.969947100 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:49.090198040 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:49.090361118 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:49.210722923 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:53.799572945 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:53.844024897 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:54.000534058 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:54.043447971 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:55.576023102 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:55.699573994 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:55.700117111 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:55.821302891 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:56.059447050 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:56.105942011 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:56.260493994 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:56.261924982 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:56.381900072 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:20:56.381967068 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:20:56.502904892 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:21:02.935982943 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:21:03.059137106 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:21:03.063983917 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:21:03.189657927 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:21:03.428020954 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:21:03.495122910 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:21:03.629128933 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:21:03.635885000 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:21:03.756211996 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:21:03.756299019 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:21:03.879225016 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:21:10.575117111 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:21:10.695091009 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:21:10.695137978 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:21:10.815167904 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:21:11.053901911 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:21:11.107950926 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:21:11.255007982 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:21:11.259082079 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:21:11.379131079 CET666649706172.93.110.112192.168.2.8
                          Nov 28, 2024 14:21:11.379343033 CET497066666192.168.2.8172.93.110.112
                          Nov 28, 2024 14:21:11.499387026 CET666649706172.93.110.112192.168.2.8
                          TimestampSource PortDest PortSource IPDest IP
                          Nov 28, 2024 14:17:10.095541000 CET6137053192.168.2.81.1.1.1
                          Nov 28, 2024 14:17:10.330732107 CET53613701.1.1.1192.168.2.8
                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                          Nov 28, 2024 14:17:10.095541000 CET192.168.2.81.1.1.10x8148Standard query (0)fat7ola0077.ddns.netA (IP address)IN (0x0001)false
                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                          Nov 28, 2024 14:17:10.330732107 CET1.1.1.1192.168.2.80x8148No error (0)fat7ola0077.ddns.net172.93.110.112A (IP address)IN (0x0001)false
                          Nov 28, 2024 14:17:12.285288095 CET1.1.1.1192.168.2.80xadd5No error (0)bg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false
                          Nov 28, 2024 14:17:12.285288095 CET1.1.1.1192.168.2.80xadd5No error (0)bg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false

                          Click to jump to process

                          Click to jump to process

                          Click to dive into process behavior distribution

                          Target ID:0
                          Start time:08:17:05
                          Start date:28/11/2024
                          Path:C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe
                          Wow64 process (32bit):true
                          Commandline:"C:\Users\user\Desktop\8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.exe"
                          Imagebase:0xa70000
                          File size:63'488 bytes
                          MD5 hash:BD29364F916D0E1BBA479E785773E00E
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Yara matches:
                          • Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000000.1393372389.0000000000A72000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
                          • Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000000.00000000.1393372389.0000000000A72000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen
                          • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.3840255353.0000000007650000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                          • Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: 00000000.00000002.3840255353.0000000007650000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                          • Rule: JoeSecurity_BrowserPasswordDump_1, Description: Yara detected BrowserPasswordDump, Source: 00000000.00000002.3840255353.0000000007650000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                          • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.3840255353.0000000007650000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                          • Rule: MALWARE_Win_zgRAT, Description: Detects zgRAT, Source: 00000000.00000002.3840255353.0000000007650000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                          • Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000002.3838322371.00000000030D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                          • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.3838322371.00000000030D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                          Reputation:low
                          Has exited:false

                          Reset < >

                            Execution Graph

                            Execution Coverage:12.2%
                            Dynamic/Decrypted Code Coverage:100%
                            Signature Coverage:0%
                            Total number of Nodes:56
                            Total number of Limit Nodes:6
                            execution_graph 44652 10c29c8 44653 10c2a0c SetWindowsHookExW 44652->44653 44655 10c2a52 44653->44655 44656 10c7ec8 DuplicateHandle 44657 10c7f5e 44656->44657 44658 10c7c80 44659 10c7cc6 GetCurrentProcess 44658->44659 44661 10c7d18 GetCurrentThread 44659->44661 44662 10c7d11 44659->44662 44663 10c7d4e 44661->44663 44664 10c7d55 GetCurrentProcess 44661->44664 44662->44661 44663->44664 44667 10c7d8b 44664->44667 44665 10c7db3 GetCurrentThreadId 44666 10c7de4 44665->44666 44667->44665 44668 10c84e0 44669 10c850e 44668->44669 44672 10c7a6c 44669->44672 44673 10c7a77 44672->44673 44674 10c9054 44673->44674 44678 10ca8dd 44673->44678 44682 10ca8e0 44673->44682 44686 10ca9b0 44673->44686 44679 10ca901 44678->44679 44680 10ca925 44679->44680 44691 10caa90 44679->44691 44680->44674 44683 10ca901 44682->44683 44684 10ca925 44683->44684 44685 10caa90 2 API calls 44683->44685 44684->44674 44685->44684 44687 10ca96b 44686->44687 44688 10ca9b2 44686->44688 44687->44674 44690 10caa90 2 API calls 44688->44690 44689 10ca9c5 44690->44689 44694 10caa9d 44691->44694 44692 10caad6 44692->44680 44694->44692 44695 10c8c84 44694->44695 44696 10c8c8f 44695->44696 44698 10cab48 44696->44698 44699 10c8cb8 44696->44699 44698->44698 44700 10c8cc3 44699->44700 44703 10c8cc8 44700->44703 44702 10cabb7 44702->44698 44704 10c8cd3 44703->44704 44709 10cbacc 44704->44709 44706 10cbed8 44706->44702 44707 10ca8e0 2 API calls 44707->44706 44708 10cbcb0 44708->44706 44708->44707 44710 10cbad7 44709->44710 44711 10cd4ca 44710->44711 44714 10cd518 44710->44714 44718 10cd524 44710->44718 44711->44708 44715 10cd51e 44714->44715 44716 10cd576 KiUserCallbackDispatcher 44715->44716 44717 10cd5a0 44715->44717 44716->44717 44717->44711 44719 10cd56b 44718->44719 44720 10cd576 KiUserCallbackDispatcher 44719->44720 44721 10cd5a0 44719->44721 44720->44721 44721->44711

                            Control-flow Graph

                            • Executed
                            • Not Executed
                            control_flow_graph 22 76f7508-76f7532 24 76fa49c-76fa4c4 22->24 25 76f7538-76f7546 22->25 26 76f754c-76f772b call 76f73d8 25->26 27 76f9c0a-76f9c11 25->27 55 76f772d-76f77a3 26->55 56 76f77a5-76f77b3 26->56 29 76f9c17-76f9cfd 27->29 30 76fa492-76fa499 27->30 359 76f9cff call 76fa581 29->359 360 76f9cff call 76fa590 29->360 40 76f9d05-76f9dc7 call 76f73d8 57 76f9dcd-76f9fb5 call 76f73d8 call 76f74b0 40->57 58 76fa269-76fa48a call 76f73d8 40->58 63 76f77bb-76f77c8 55->63 56->63 94 76fa10c-76fa257 call 76f73d8 57->94 95 76f9fbb-76fa107 call 76f73d8 57->95 361 76fa48c call 76fafa8 58->361 362 76fa48c call 76faf80 58->362 363 76fa48c call 76faf90 58->363 65 76f77ce-76f79b3 call 76f73d8 call 76f74b0 63->65 66 76f9c00-76f9c07 63->66 105 76f79c7-76f7bad 65->105 106 76f79b5-76f79c4 65->106 130 76fa25f-76fa263 94->130 95->130 105->24 132 76f7bb3-76f7f43 105->132 106->105 130->57 130->58 148 76f7f45-76f7f6e 132->148 148->24 151 76f7f74-76f7f81 148->151 152 76f7f94-76f7fac 151->152 153 76f7f83 151->153 159 76f7fae-76f8022 152->159 160 76f8027-76f809b 152->160 154 76f809d-76f80a8 153->154 155 76f7f89-76f7f8e 153->155 154->24 156 76f80ae-76f80b5 154->156 155->152 155->154 156->24 158 76f80bb-76f80da 156->158 161 76f80de-76f80e2 158->161 159->161 160->161 161->148 162 76f80e8-76f8154 call 76f74b0 161->162 172 76f815a-76f8166 162->172 173 76f82b5-76f8341 call 76f74b0 162->173 172->24 174 76f816c-76f8282 call 76f7290 172->174 182 76f8347-76f8353 173->182 183 76f84a4-76f8530 call 76f74b0 173->183 174->24 189 76f8288-76f82b0 call 76f7348 174->189 182->24 185 76f8359-76f8471 182->185 197 76f868f-76f86fb call 76f74b0 183->197 198 76f8536-76f8542 183->198 185->24 207 76f8477-76f849f call 76f7348 185->207 189->197 208 76f88cc-76f8958 call 76f74b0 197->208 209 76f8701-76f870d 197->209 198->24 200 76f8548-76f8661 198->200 200->24 226 76f8667-76f8687 call 76f7348 200->226 207->197 227 76f8b4e-76f8bda call 76f74b0 208->227 228 76f895e-76f896a 208->228 209->24 212 76f8713-76f8803 call 76f7290 209->212 212->24 229 76f8809-76f8899 212->229 226->197 242 76f8dcb-76f8de9 227->242 243 76f8be0-76f8bec 227->243 228->24 231 76f8970-76f8a77 228->231 229->24 247 76f889f-76f88c7 call 76f7348 229->247 231->24 250 76f8a7d-76f8b1b 231->250 242->24 246 76f8def-76f8eb3 242->246 243->24 245 76f8bf2-76f8cf9 243->245 245->24 264 76f8cff-76f8d9d 245->264 246->24 258 76f8eb9-76f8f31 246->258 247->242 250->24 266 76f8b21-76f8b49 call 76f7348 250->266 258->24 267 76f8f37-76f8faf 258->267 264->24 277 76f8da3-76f8dc3 call 76f7348 264->277 266->242 267->24 276 76f8fb5-76f9046 267->276 276->24 283 76f904c-76f90ce call 76f73d8 call 76f74b0 276->283 277->242 289 76f941e-76f94aa call 76f74b0 283->289 290 76f90d4-76f90e0 283->290 299 76f980a-76f9896 call 76f74b0 289->299 300 76f94b0-76f94bc 289->300 290->24 291 76f90e6-76f9347 call 76f7290 290->291 291->24 324 76f934d-76f93eb 291->324 313 76f989c-76f98a8 299->313 314 76f9bf1-76f9bfa 299->314 300->24 302 76f94c2-76f9733 300->302 302->24 338 76f9739-76f97d7 302->338 313->24 316 76f98ae-76f9b1f 313->316 314->65 314->66 316->24 349 76f9b25-76f9bc3 316->349 324->24 334 76f93f1-76f9419 call 76f7348 324->334 334->314 338->24 348 76f97dd-76f9805 call 76f7348 338->348 348->314 349->24 356 76f9bc9-76f9be9 call 76f7348 349->356 356->314 359->40 360->40 361->30 362->30 363->30
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 2c1efd861a332deee4ad5e7fcd87f9f56fd32708321f51b2f9d53c7fa13f9c43
                            • Instruction ID: 1e5c25e774207f65b41658053496556861bbef19e9b3bccb070691781acbf0ee
                            • Opcode Fuzzy Hash: 2c1efd861a332deee4ad5e7fcd87f9f56fd32708321f51b2f9d53c7fa13f9c43
                            • Instruction Fuzzy Hash: 7163D331D10B5A8ACB11EF68C894999F7B1FF99300F11D79AE44977221EB70AAC5CF81

                            Control-flow Graph

                            • Executed
                            • Not Executed
                            control_flow_graph 364 76fb668-76fb67f 366 76fd385-76fd3a6 364->366 367 76fb685-76fb68d 364->367 374 76fd3af-76fd3b1 366->374 375 76fd3a8-76fd3aa 366->375 368 76fcdc8-76fcdcb 367->368 369 76fb693-76fb810 call 76fa500 call 76fa590 call 76f73d8 call 76fa608 call 76fa590 367->369 370 76fd376-76fd382 368->370 371 76fcdd1-76fcf28 call 76fa500 call 76fa590 call 76f73d8 call 76fa608 call 76fa698 368->371 410 76fb854-76fb862 369->410 411 76fb812-76fb852 call 76faf90 369->411 416 76fcf2e-76fd193 call 76fa500 * 2 call 76fa590 call 76f73d8 * 2 call 76fa608 call 76fa710 call 76fa7a0 371->416 417 76fd199-76fd36e call 76fa500 call 76fa590 call 76f73d8 call 76fa608 call 76fa710 call 76fa7a0 371->417 377 76fd3b3-76fd3cc 374->377 376 76fd3ac 375->376 375->377 376->374 668 76fd3cf call 76fd568 377->668 669 76fd3cf call 76fd578 377->669 382 76fd3d5-76fd415 391 76fd50e-76fd523 382->391 392 76fd41b-76fd44c call 76f2d30 382->392 400 76fd524 391->400 413 76fd44e-76fd455 392->413 414 76fd481-76fd508 call 76f2d30 392->414 400->400 429 76fb86a-76fb873 410->429 411->429 413->414 415 76fd457-76fd47d 413->415 414->391 414->392 415->414 416->417 417->370 429->370 433 76fb879-76fba61 call 76fa500 * 2 call 76fa590 call 76f73d8 call 76f74b0 429->433 482 76fba75-76fbc56 call 76fa7e0 call 76fa850 call 76fa608 call 76fa500 * 2 call 76fa590 call 76fa7e0 433->482 483 76fba63-76fba72 433->483 482->366 504 76fbc5c-76fc0ef call 76fa608 call 76fa500 * 2 call 76fa590 call 76fa850 call 76fa608 call 76fa500 * 2 call 76fa7a0 call 76fa7e0 call 76fa850 call 76fa608 call 76fa500 482->504 483->482 536 76fc0f1 504->536 537 76fc100-76fc150 call 76faf90 call 76fa7e0 504->537 538 76fc0f7-76fc0fa 536->538 539 76fc2f3-76fc2ff 536->539 537->366 555 76fc156-76fc182 call 76fa850 537->555 538->537 538->539 539->366 540 76fc305-76fc33d 539->540 547 76fcdb4-76fcdbd 540->547 548 76fc343-76fc34e 540->548 547->433 551 76fcdc3 547->551 548->366 552 76fc354-76fc361 548->552 551->370 553 76fc373-76fc38f call 76faad0 552->553 554 76fc363 552->554 565 76fca4f-76fca5b 553->565 566 76fc395-76fc401 call 76f74b0 553->566 556 76fcbfb-76fcc19 554->556 557 76fc369-76fc36d 554->557 563 76fc195-76fc1b1 call 76faad0 555->563 564 76fc184 555->564 556->366 562 76fcc1f-76fcd8d call 76fa500 * 2 call 76fa590 call 76f73d8 556->562 557->553 557->556 634 76fcd98-76fcdae 562->634 580 76fc225-76fc292 call 76fab30 563->580 581 76fc1b3-76fc220 call 76fab30 563->581 568 76fc18a-76fc18f 564->568 569 76fc294-76fc2a9 564->569 565->366 567 76fca61-76fcbf6 call 76f7290 call 76fa500 * 2 call 76fa590 call 76f7348 565->567 590 76fc407-76fc413 566->590 591 76fc5b3-76fc63f call 76f74b0 566->591 567->634 568->563 568->569 569->366 573 76fc2af-76fc2bd 569->573 578 76fc2c5-76fc2e2 573->578 578->539 583 76fc2e4 578->583 580->578 581->578 583->537 589 76fc2ea-76fc2ed 583->589 589->537 589->539 590->366 595 76fc419-76fc5ae call 76f7290 call 76fa500 * 2 call 76fa590 call 76f7348 590->595 617 76fc645-76fc651 591->617 618 76fc801-76fc88d call 76f74b0 591->618 595->634 617->366 621 76fc657-76fc7fc call 76fa500 * 2 call 76fa590 call 76f7348 617->621 618->634 641 76fc893-76fc89f 618->641 621->634 634->547 634->548 641->366 644 76fc8a5-76fca4a call 76fa500 * 2 call 76fa590 call 76f7348 641->644 644->634 668->382 669->382
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: e7e06cf6a46e8a48a51be1470a3f81d927ecb4ed9fe11b69cb3bbb935ad7c612
                            • Instruction ID: 295f98a174491af5e4cb751e1becd245aa442d57094e23e35189e02be8606523
                            • Opcode Fuzzy Hash: e7e06cf6a46e8a48a51be1470a3f81d927ecb4ed9fe11b69cb3bbb935ad7c612
                            • Instruction Fuzzy Hash: AE13F771D10B1A8ACB11EF68C89099AF7B1FF99300F50D79AD45977224EB70AAC4CF81
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 44f9f2bed002ca02821a759a901c1c446d262cbe6a18509ddad487b3a4334dc8
                            • Instruction ID: 10e809f4a4f5489b17e55b60d21a073569752273fafbd1e6ab9d42d08a0f35d4
                            • Opcode Fuzzy Hash: 44f9f2bed002ca02821a759a901c1c446d262cbe6a18509ddad487b3a4334dc8
                            • Instruction Fuzzy Hash: 855234B6A00115DFDB15CF68C994E99BBB2FF89304F1581A8E60A9B262CB31EC55DF40
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 978da8ef55d63a5bf1160b486f7e2bbf718945a607921662810fce3c481fd97c
                            • Instruction ID: 3d7a327f06bcda945c9eca002f8da3f8b0557e1737b1c41a9cd017c140becff7
                            • Opcode Fuzzy Hash: 978da8ef55d63a5bf1160b486f7e2bbf718945a607921662810fce3c481fd97c
                            • Instruction Fuzzy Hash: E3429CB0A00351DFDB24DF28D548AAAB7F2FF85305F94486AD406CB790DB79E896DB10
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 9efae44cc1128861d0aa8870cc4149978178c1e244dd71acea665c2cb5368045
                            • Instruction ID: afcaed9e11ec8a2c123ddc4ab41ef00d30f6bb43e9726379937778b85651bbb6
                            • Opcode Fuzzy Hash: 9efae44cc1128861d0aa8870cc4149978178c1e244dd71acea665c2cb5368045
                            • Instruction Fuzzy Hash: 031293B4B002059FDB14DF78C554AAEBBF6FF88610B19816AD805EB365DB31EC06CB90
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: fe5d01c7342c0b5619c46b2d02958aa6707105dfe133d630f72014613b1be953
                            • Instruction ID: 89553be7792505d36f23e6654ed36d88eb55cb34c9adc7d265763a8b1c8c934e
                            • Opcode Fuzzy Hash: fe5d01c7342c0b5619c46b2d02958aa6707105dfe133d630f72014613b1be953
                            • Instruction Fuzzy Hash: 74F14DB0A00315DFDB08DFA4D494AAEBBF2FF88300F54856AE816AB355DB35D856CB50

                            Control-flow Graph

                            APIs
                            • GetCurrentProcess.KERNEL32 ref: 010C7CFE
                            • GetCurrentThread.KERNEL32 ref: 010C7D3B
                            • GetCurrentProcess.KERNEL32 ref: 010C7D78
                            • GetCurrentThreadId.KERNEL32 ref: 010C7DD1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3837716619.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_10c0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID: Current$ProcessThread
                            • String ID:
                            • API String ID: 2063062207-0
                            • Opcode ID: 8aa15be7f2d56853a6e3a02088d72f3060f283c334dd801be723b41e00f81adf
                            • Instruction ID: 96e3615a80e3d10a675db86a08ed8458829b8d308de6d9f12254838b4c25bda6
                            • Opcode Fuzzy Hash: 8aa15be7f2d56853a6e3a02088d72f3060f283c334dd801be723b41e00f81adf
                            • Instruction Fuzzy Hash: F55158B09003498FDB14DFAAD448BAEBBF5BF88314F20845DE419AB3A4D7755844CF65

                            Control-flow Graph

                            • Executed
                            • Not Executed
                            control_flow_graph 804 74206e0-74206fb 805 7420707-7420716 804->805 806 74206fd-74206ff 804->806 807 7420722-7420757 805->807 808 7420718 805->808 806->805 810 7420990-74209d7 807->810 811 742075d-7420763 807->811 808->807 839 74209d9 810->839 840 74209ed-74209f9 810->840 812 7420769-742076f 811->812 813 742083c-7420840 811->813 812->810 814 7420775-7420782 812->814 816 7420842-742084b 813->816 817 7420863-742086c 813->817 818 742081b-7420824 814->818 819 7420788-7420791 814->819 816->810 820 7420851-7420861 816->820 821 7420891-7420894 817->821 822 742086e-742087a 817->822 818->810 826 742082a-7420836 818->826 819->810 823 7420797-74207b8 819->823 825 7420897-742089d 820->825 821->825 833 7420882-742088e 822->833 828 74207c4-74207df 823->828 829 74207ba 823->829 825->810 830 74208a3-74208b6 825->830 826->812 826->813 828->818 838 74207e1-74207e7 828->838 829->828 830->810 832 74208bc-74208cc 830->832 832->810 834 74208d2-74208df 832->834 833->821 834->810 837 74208e5-742090a 834->837 837->810 854 7420910-7420928 837->854 841 74207f3-74207f9 838->841 842 74207e9 838->842 843 74209dc-74209de 839->843 845 7420a05-7420a21 840->845 846 74209fb 840->846 841->810 847 74207ff-7420818 841->847 842->841 848 7420a22-7420a35 843->848 849 74209e0-74209eb 843->849 846->845 856 7420a77-7420a8a 848->856 857 7420a37-7420a53 848->857 849->840 849->843 854->810 863 742092a-7420935 854->863 860 7420a9c 856->860 861 7420a8c-7420a9a 856->861 858 7420a55 857->858 859 7420a5f-7420a66 857->859 858->859 864 7420a9e-7420aa2 860->864 861->864 866 7420986-742098d 863->866 867 7420937-7420941 863->867 868 7420ab7 864->868 869 7420aa4-7420ab5 864->869 867->866 874 7420943-7420959 867->874 871 7420ab9-7420ac0 868->871 869->871 876 7420965-742097e 874->876 877 742095b 874->877 876->866 877->876
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID: d
                            • API String ID: 0-2564639436
                            • Opcode ID: b490727f8a4a337b32fd76526c69f6975856307b9e689edac93f4e9c4f708390
                            • Instruction ID: 1cd835cd5f1d8977f4ece11e9161961acd2e1c4894a504f6487daa37ce06b18b
                            • Opcode Fuzzy Hash: b490727f8a4a337b32fd76526c69f6975856307b9e689edac93f4e9c4f708390
                            • Instruction Fuzzy Hash: 02D19975600616CFC714CF19C4809AAB7F6FF89310B65CA6AE49A8B761DB30FC52CB94
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 13d22f7763946e4ba3e9ff66d52c94b87fe4ba80529bb4e4d926cb957c6a6adf
                            • Instruction ID: 380abee55acc84d2b13624898fb15abdf4cae12bf4d3725d3c5d4655ed4bf4d6
                            • Opcode Fuzzy Hash: 13d22f7763946e4ba3e9ff66d52c94b87fe4ba80529bb4e4d926cb957c6a6adf
                            • Instruction Fuzzy Hash: 7FD24B74B023098FDB58EB34D0646AD37E7FBCA202B1049ADD50A9B355EF399C86DB41

                            Control-flow Graph

                            • Executed
                            • Not Executed
                            control_flow_graph 1436 10c7ec0-10c7f5c DuplicateHandle 1437 10c7f5e-10c7f64 1436->1437 1438 10c7f65-10c7f82 1436->1438 1437->1438
                            APIs
                            • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 010C7F4F
                            Memory Dump Source
                            • Source File: 00000000.00000002.3837716619.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_10c0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID: DuplicateHandle
                            • String ID:
                            • API String ID: 3793708945-0
                            • Opcode ID: 877290dee0880b007d8321f034984437545744d36cd121e851901cc1be92c460
                            • Instruction ID: 3bf81dc272c2d119a1bda5f3c68f963cf2486fbeb8f4a38d705a7bcd24927f69
                            • Opcode Fuzzy Hash: 877290dee0880b007d8321f034984437545744d36cd121e851901cc1be92c460
                            • Instruction Fuzzy Hash: 282100B59002099FDB10CFAAD885AEEBBF5FB48310F14801AE918A3350C378A940CFA0

                            Control-flow Graph

                            • Executed
                            • Not Executed
                            control_flow_graph 1441 10c7ec8-10c7f5c DuplicateHandle 1442 10c7f5e-10c7f64 1441->1442 1443 10c7f65-10c7f82 1441->1443 1442->1443
                            APIs
                            • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 010C7F4F
                            Memory Dump Source
                            • Source File: 00000000.00000002.3837716619.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_10c0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID: DuplicateHandle
                            • String ID:
                            • API String ID: 3793708945-0
                            • Opcode ID: ea5a5a84bc5738617e90d4f4dfd5688701e4a64a4989ed111d5c28eb3297d51d
                            • Instruction ID: 668f8144d9a70a6ca6caa7fd8d68cef7dc67da102e7691de4f2f033916092851
                            • Opcode Fuzzy Hash: ea5a5a84bc5738617e90d4f4dfd5688701e4a64a4989ed111d5c28eb3297d51d
                            • Instruction Fuzzy Hash: A821E4B59002099FDB10CFAAD884ADEFFF8FB48710F14801AE958A3350D374A944CF60

                            Control-flow Graph

                            • Executed
                            • Not Executed
                            control_flow_graph 1456 10c29c8-10c2a12 1458 10c2a1e-10c2a50 SetWindowsHookExW 1456->1458 1459 10c2a14 1456->1459 1460 10c2a59-10c2a7e 1458->1460 1461 10c2a52-10c2a58 1458->1461 1462 10c2a1c 1459->1462 1461->1460 1462->1458
                            APIs
                            • SetWindowsHookExW.USER32(?,00000000,?,?), ref: 010C2A43
                            Memory Dump Source
                            • Source File: 00000000.00000002.3837716619.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_10c0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID: HookWindows
                            • String ID:
                            • API String ID: 2559412058-0
                            • Opcode ID: 3b755f3456faecc2d306a2b564de383678a8f5595fc9a581ebf95a57c7642a72
                            • Instruction ID: cb3683365cc5de51b77f696b0e3c1d44a70a07c98df3f48ce3e56b983601d13a
                            • Opcode Fuzzy Hash: 3b755f3456faecc2d306a2b564de383678a8f5595fc9a581ebf95a57c7642a72
                            • Instruction Fuzzy Hash: 08212775D002098FDB24DFAAC844BDEFBF5BF88710F108429D455A7250C774A944CFA0

                            Control-flow Graph

                            • Executed
                            • Not Executed
                            control_flow_graph 1446 10c29c7-10c2a12 1448 10c2a1e-10c2a50 SetWindowsHookExW 1446->1448 1449 10c2a14 1446->1449 1450 10c2a59-10c2a7e 1448->1450 1451 10c2a52-10c2a58 1448->1451 1452 10c2a1c 1449->1452 1451->1450 1452->1448
                            APIs
                            • SetWindowsHookExW.USER32(?,00000000,?,?), ref: 010C2A43
                            Memory Dump Source
                            • Source File: 00000000.00000002.3837716619.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_10c0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID: HookWindows
                            • String ID:
                            • API String ID: 2559412058-0
                            • Opcode ID: 8d7b1832ccc526fd5f9c84db76a5cf3905df6f75bbf79b95e58190b197aed44c
                            • Instruction ID: 1fc2b76f3d6a7fdd0e41b1398e8f3b607b6a4fbb4b7003dbd6ca5afef16f80e1
                            • Opcode Fuzzy Hash: 8d7b1832ccc526fd5f9c84db76a5cf3905df6f75bbf79b95e58190b197aed44c
                            • Instruction Fuzzy Hash: 78211375D002098FDB64DFAAD844BEEFBF5BF88720F10842AD459A7290C774A944CFA0

                            Control-flow Graph

                            • Executed
                            • Not Executed
                            control_flow_graph 1466 10cd518-10cd574 1470 10cd576-10cd59e KiUserCallbackDispatcher 1466->1470 1471 10cd5c2-10cd5db 1466->1471 1472 10cd5a7-10cd5bb 1470->1472 1473 10cd5a0-10cd5a6 1470->1473 1472->1471 1473->1472
                            APIs
                            • KiUserCallbackDispatcher.NTDLL(0000004B), ref: 010CD58D
                            Memory Dump Source
                            • Source File: 00000000.00000002.3837716619.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_10c0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID: CallbackDispatcherUser
                            • String ID:
                            • API String ID: 2492992576-0
                            • Opcode ID: de44dae3f3f582a13f8bce68d01502c2208853982b4d4cde340f1f2095afd76d
                            • Instruction ID: 98ccacfe7459c18ece2f51573d74bb3cade12bbf6e415d8056cfc4effcb6309c
                            • Opcode Fuzzy Hash: de44dae3f3f582a13f8bce68d01502c2208853982b4d4cde340f1f2095afd76d
                            • Instruction Fuzzy Hash: CE118CB5804389CEDB21CF99C4447EEBFF4AB69754F1440AAD499A7292C3399608CFA1

                            Control-flow Graph

                            • Executed
                            • Not Executed
                            control_flow_graph 1475 10cd524-10cd574 1477 10cd576-10cd59e KiUserCallbackDispatcher 1475->1477 1478 10cd5c2-10cd5db 1475->1478 1479 10cd5a7-10cd5bb 1477->1479 1480 10cd5a0-10cd5a6 1477->1480 1479->1478 1480->1479
                            APIs
                            • KiUserCallbackDispatcher.NTDLL(0000004B), ref: 010CD58D
                            Memory Dump Source
                            • Source File: 00000000.00000002.3837716619.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_10c0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID: CallbackDispatcherUser
                            • String ID:
                            • API String ID: 2492992576-0
                            • Opcode ID: 3cd5613dd34ae68100f1f079b6a2880040811d554d710de9e7291ff940246214
                            • Instruction ID: 42d194eb89d82e306436cd759c7ef5d0efd83e6a828c7abadbe2202606d6d8d2
                            • Opcode Fuzzy Hash: 3cd5613dd34ae68100f1f079b6a2880040811d554d710de9e7291ff940246214
                            • Instruction Fuzzy Hash: C7118EB5800389CEDB20DF99D0443EEBFF4AB59714F144099D5A9B7252D3795608CFA1

                            Control-flow Graph

                            • Executed
                            • Not Executed
                            control_flow_graph 1482 7425958-74259d8 1487 7425d13-7425d64 1482->1487 1488 74259de-7425a0d 1482->1488 1492 7425d66-7425d8a 1487->1492 1493 7425cfb-7425d01 1487->1493 1501 7425a22-7425acf 1488->1501 1502 7425a0f-7425a1a 1488->1502 1503 7425da4-7425da9 1492->1503 1504 7425d8c-7425da3 1492->1504 1497 7425d0b-7425d0d 1493->1497 1497->1487 1497->1488 1520 7425ad5-7425af0 1501->1520 1521 7425cee-7425cf6 1501->1521 1502->1501 1523 7425cfe-7425d01 1520->1523 1525 7425af6-7425b26 1520->1525 1521->1523 1523->1497 1529 7425c33-7425c4c 1525->1529 1530 7425b2c-7425b45 1525->1530 1532 7425c57-7425c58 1529->1532 1533 7425c4e 1529->1533 1537 7425b47-7425b65 1530->1537 1538 7425bbf-7425bcd 1530->1538 1532->1521 1533->1532 1546 7425b67-7425b6a 1537->1546 1547 7425b6c-7425b85 1537->1547 1541 7425be1-7425bef 1538->1541 1542 7425bcf-7425bd7 1538->1542 1549 7425c01-7425c0f 1541->1549 1550 7425bf1-7425bff 1541->1550 1567 7425bd9 call 74261e8 1542->1567 1568 7425bd9 call 74261f8 1542->1568 1544 7425bdf 1548 7425c22-7425c2d 1544->1548 1551 7425bae-7425bb5 1546->1551 1559 7425b87-7425b8c 1547->1559 1560 7425b8e-7425ba7 1547->1560 1548->1529 1548->1530 1549->1548 1558 7425c11-7425c1f 1549->1558 1550->1548 1565 7425bb7 call 74261e8 1551->1565 1566 7425bb7 call 74261f8 1551->1566 1554 7425bbd 1554->1548 1558->1548 1559->1551 1560->1551 1564 7425ba9 1560->1564 1564->1551 1565->1554 1566->1554 1567->1544 1568->1544
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID: K+
                            • API String ID: 0-1526790930
                            • Opcode ID: 448210eaf67032774dcec403c3630aaf001165dc79b7d306283dbb7261af1254
                            • Instruction ID: c8b720dfd17f4240b56a11f11fc9a8f9c706f4ce5c62751de8a2e2a44cbd2d2e
                            • Opcode Fuzzy Hash: 448210eaf67032774dcec403c3630aaf001165dc79b7d306283dbb7261af1254
                            • Instruction Fuzzy Hash: B2A17EB4B002159FDB14DFA5C554AAEBBF2BF88700B24855AD806DB364EF70EC12CB90

                            Control-flow Graph

                            • Executed
                            • Not Executed
                            control_flow_graph 1569 742594a-7425951 1570 7425953-7425993 1569->1570 1571 7425996-74259d8 1569->1571 1570->1571 1574 7425d13-7425d64 1571->1574 1575 74259de-7425a0d 1571->1575 1580 7425d66-7425d8a 1574->1580 1581 7425cfb-7425d01 1574->1581 1589 7425a22-7425acf 1575->1589 1590 7425a0f-7425a1a 1575->1590 1591 7425da4-7425da9 1580->1591 1592 7425d8c-7425da3 1580->1592 1585 7425d0b-7425d0d 1581->1585 1585->1574 1585->1575 1608 7425ad5-7425af0 1589->1608 1609 7425cee-7425cf6 1589->1609 1590->1589 1611 7425cfe-7425d01 1608->1611 1613 7425af6-7425b26 1608->1613 1609->1611 1611->1585 1617 7425c33-7425c4c 1613->1617 1618 7425b2c-7425b45 1613->1618 1620 7425c57-7425c58 1617->1620 1621 7425c4e 1617->1621 1625 7425b47-7425b65 1618->1625 1626 7425bbf-7425bcd 1618->1626 1620->1609 1621->1620 1634 7425b67-7425b6a 1625->1634 1635 7425b6c-7425b85 1625->1635 1629 7425be1-7425bef 1626->1629 1630 7425bcf-7425bd7 1626->1630 1637 7425c01-7425c0f 1629->1637 1638 7425bf1-7425bff 1629->1638 1655 7425bd9 call 74261e8 1630->1655 1656 7425bd9 call 74261f8 1630->1656 1632 7425bdf 1636 7425c22-7425c2d 1632->1636 1639 7425bae-7425bb5 1634->1639 1647 7425b87-7425b8c 1635->1647 1648 7425b8e-7425ba7 1635->1648 1636->1617 1636->1618 1637->1636 1646 7425c11-7425c1f 1637->1646 1638->1636 1653 7425bb7 call 74261e8 1639->1653 1654 7425bb7 call 74261f8 1639->1654 1642 7425bbd 1642->1636 1646->1636 1647->1639 1648->1639 1652 7425ba9 1648->1652 1652->1639 1653->1642 1654->1642 1655->1632 1656->1632
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID: K+
                            • API String ID: 0-1526790930
                            • Opcode ID: 8445e7f820266feb6748d799647b5aa7a455a18aa50c55a3f4b4e07ba0031863
                            • Instruction ID: 352e6cd0a733e78e0f07652b9f45039529685b6bcf34413d76e4b80d243813ba
                            • Opcode Fuzzy Hash: 8445e7f820266feb6748d799647b5aa7a455a18aa50c55a3f4b4e07ba0031863
                            • Instruction Fuzzy Hash: 667181B0A007159FDB14DFA4C554A9EBBF2FFC8300B14856AD80AAB364DB70ED06CB90

                            Control-flow Graph

                            • Executed
                            • Not Executed
                            control_flow_graph 1657 7449758-744976b 1658 7449777-7449779 1657->1658 1659 744976d-744976f 1657->1659 1660 7449782-744979c 1658->1660 1659->1658 1661 74497a2-74497a7 1660->1661 1662 74498ef-744993f 1660->1662 1663 7449801-7449806 1661->1663 1664 74497a9 1661->1664 1665 7449826-744982f 1663->1665 1666 7449808-7449811 1663->1666 1667 74497ac-74497af 1664->1667 1670 7449831-7449845 1665->1670 1671 7449848-744984e 1665->1671 1666->1662 1669 7449817-7449824 1666->1669 1667->1662 1672 74497b5-74497c1 1667->1672 1673 7449851-744985a 1669->1673 1670->1671 1671->1673 1674 74497e4-74497ed 1672->1674 1675 74497c3-74497d8 1672->1675 1673->1662 1679 7449860-7449888 1673->1679 1674->1662 1677 74497f3-74497ff 1674->1677 1675->1674 1685 74497da-74497e3 1675->1685 1677->1663 1677->1667 1679->1662 1680 744988a-74498a8 1679->1680 1683 74498e2-74498ee 1680->1683 1684 74498aa-74498b4 1680->1684 1684->1683 1689 74498b6-74498da 1684->1689 1689->1683
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID: d
                            • API String ID: 0-2564639436
                            • Opcode ID: cc795fb59a9ed9c73865f5aa2443bb14ea2060e36a2e67523f1084c4324e5d33
                            • Instruction ID: fbd4dc9618e426bea43941d1a294e9d15a5fc3d8f77cccb64a7c02851ea9c94d
                            • Opcode Fuzzy Hash: cc795fb59a9ed9c73865f5aa2443bb14ea2060e36a2e67523f1084c4324e5d33
                            • Instruction Fuzzy Hash: D3619AB0A00606CFDB14DF59C5C08AAF7B6FF88310B51C66AC91A9B715DB30F861DB90
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID: ^5t
                            • API String ID: 0-1343020086
                            • Opcode ID: d218de1e3c82f05ba1f640526c899a70675c855ab1a835017b2a939ced272fff
                            • Instruction ID: 1bfa7e15b34c321e9f0692fbe224122d0ebbfd38291eabcbac18671bf47f83fb
                            • Opcode Fuzzy Hash: d218de1e3c82f05ba1f640526c899a70675c855ab1a835017b2a939ced272fff
                            • Instruction Fuzzy Hash: 8C411975B00214CFDB14EB68D994AAEB7F7EFC9211F244529D806AB394DE35ED42CB80
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: fbb13f3a4bf727b0fe84c5bf4f41bf2c6f1f215d01e5328b548ec48ca7a74cea
                            • Instruction ID: 8a4e3503cc0c134ed6335b5059943e784b8303388a12dde5b01a75177867009f
                            • Opcode Fuzzy Hash: fbb13f3a4bf727b0fe84c5bf4f41bf2c6f1f215d01e5328b548ec48ca7a74cea
                            • Instruction Fuzzy Hash: D1123AB47006058FDB14DF39C594AAABBF2FF89701B1984A9E506DB362DB34EC46CB50
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 17aba7d5f3541bbd5e7547242d6eb36bbdb99d4b83caf902961dc9f806d44a59
                            • Instruction ID: c547c0bee00888ac2e76d430a0bd9b53e5c0a0b2a29d078cb8c927de5d3a2225
                            • Opcode Fuzzy Hash: 17aba7d5f3541bbd5e7547242d6eb36bbdb99d4b83caf902961dc9f806d44a59
                            • Instruction Fuzzy Hash: FDF19CB0B003669BDB11EB6CD850ADE77E6FFC5600B50852AE815DB344EF38EC169B90
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: fe30d2ff591f740c37c45ff8017e1b16b95bed5e5ac3d824214b0d69f1025441
                            • Instruction ID: d2ea41ffeb7426c83a58c6f560d1ae35b7f72aaa1627a20e32c2dfe26259da84
                            • Opcode Fuzzy Hash: fe30d2ff591f740c37c45ff8017e1b16b95bed5e5ac3d824214b0d69f1025441
                            • Instruction Fuzzy Hash: 1DD1B471B042058FD715DB78D890AAE7BB6FF8A320F244166E606DB391CB35DC45CBA1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 80e4493b88b6a3a264f6c51d712e6009eaaebe66f97293ceb9b5ef0e11b56f48
                            • Instruction ID: 79e847074301d7eba531b88bb69723efe5c8494fd4dbf1b1a9cb952371d29891
                            • Opcode Fuzzy Hash: 80e4493b88b6a3a264f6c51d712e6009eaaebe66f97293ceb9b5ef0e11b56f48
                            • Instruction Fuzzy Hash: 78F16AB57006018FDB14DF2AC489AAABBF2FF85214F59846AE546CB761CB34EC01DB52
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 20374494ccb217a6faf889521edaf8323cfe578ea721574bebd4a5ff751d1dc2
                            • Instruction ID: 095296223480ecb3f869c3cec7497271c81464b28da3b0e3aa0ffff311fc36ae
                            • Opcode Fuzzy Hash: 20374494ccb217a6faf889521edaf8323cfe578ea721574bebd4a5ff751d1dc2
                            • Instruction Fuzzy Hash: 1CE12DB9703244AFD704EF58E841E6A7B26FB88714B108125FD11A7388DB7E7C4ADB81
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 720546973dc9261c20c51aa4b9ee3c9a74d17d12dabbea2ca3d951b993629222
                            • Instruction ID: 817001b92e413c3e3cc52501697d234761e836a1b687692b9787427f5beef97c
                            • Opcode Fuzzy Hash: 720546973dc9261c20c51aa4b9ee3c9a74d17d12dabbea2ca3d951b993629222
                            • Instruction Fuzzy Hash: 86E11CB9703240AFD745EF68E851A6A7B26FB88710B108125FD11A7388DF7E7C49DB81
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: d18ca8cea38b5f4c439fb82cf72d30b472f17f98fc0455a58cfe03e7f1c83b07
                            • Instruction ID: bb886398d60bf017b3764f5ffd8286edcc454c72197b9f9286e2bae961ec93cd
                            • Opcode Fuzzy Hash: d18ca8cea38b5f4c439fb82cf72d30b472f17f98fc0455a58cfe03e7f1c83b07
                            • Instruction Fuzzy Hash: AAC1E475B012098FDB05EF78E4545AEBBF6FF85200B14816AD806EB355DF39AC0ACB91
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 3b5a94cf27d34fa23930e4affd793ba6b62323eb354a1e61c96be64967f78251
                            • Instruction ID: a448ed72d8419fd9de6de74581e17b7fa5f12989d150cf09dd6e35ccd486b90b
                            • Opcode Fuzzy Hash: 3b5a94cf27d34fa23930e4affd793ba6b62323eb354a1e61c96be64967f78251
                            • Instruction Fuzzy Hash: ECC1B1B4B05222DFDB258B20D44476AF7E2AF85701F5489AAE8068B384CB35DC63DBD0
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: e077505e43a4c26fbba893b49f63efbc83d8e4254fb41571be86afef914c127f
                            • Instruction ID: 8cd0189b95d972c69ab4c568f13c83e28a8d28a1911e2babff1ee3a3369029eb
                            • Opcode Fuzzy Hash: e077505e43a4c26fbba893b49f63efbc83d8e4254fb41571be86afef914c127f
                            • Instruction Fuzzy Hash: 95D12DB9703240AFD704EF68E845E6A7B26FB88714B108124FD01A7388DB7E7C49DB81
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: bc4bb4f0113e13fc34a1cad65147bcd90082bffcf618c912d78cce5aa1b92515
                            • Instruction ID: 8587915d220f0688e672bb5f45cd4d1e4b35170ee0792f20ee43d5fcad87a47d
                            • Opcode Fuzzy Hash: bc4bb4f0113e13fc34a1cad65147bcd90082bffcf618c912d78cce5aa1b92515
                            • Instruction Fuzzy Hash: 7CB19BB0700722CFD7608E29CA447ABB7F6AF84200F54882ADC46C7795DB34E852DBA5
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: a0c6c83d4ea8433f3495ac732bd344fdbf9e0eb7185b13720766bff8b811834d
                            • Instruction ID: 0606e5816c556ee266429b356df6996100804bf24c04deafd32b5b1ff56075d2
                            • Opcode Fuzzy Hash: a0c6c83d4ea8433f3495ac732bd344fdbf9e0eb7185b13720766bff8b811834d
                            • Instruction Fuzzy Hash: BDB182B5B011099FCB04EF78D8449AEBBF6FF89210B148129D946A7754DF39AC0ACB91
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: fe372474171a3ffdc364db321ec8205c54a38a9d37f8c36a9578d248750dc299
                            • Instruction ID: 49e2dee806c6cfbba5f983c2c732b0a0995009c725ebb0831ad56a98820fe892
                            • Opcode Fuzzy Hash: fe372474171a3ffdc364db321ec8205c54a38a9d37f8c36a9578d248750dc299
                            • Instruction Fuzzy Hash: E391EEB0714261AFDB44AA69C8407EB3BE6EFC5200B54886BE605CB7A5DF31CC53D790
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 2735ce8c52791e75a97f0a30c77b3922a35a36b765f508f02fcfb43ea76376c7
                            • Instruction ID: 8c17183b6480d133e3cf1f2bb559179bb23fdd21e736cf70f7b166cf3d511208
                            • Opcode Fuzzy Hash: 2735ce8c52791e75a97f0a30c77b3922a35a36b765f508f02fcfb43ea76376c7
                            • Instruction Fuzzy Hash: 7191CDB0B012069FCB15DF78C4946AEBBB6BF85310F14856AD916AB381DB31FD46CB90
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: b33891706014834bae6f66e7f3b9f1509c86146735c56852f61a9bbf6d09b47d
                            • Instruction ID: 31c87d2478511b7c1e0d2f80efe3107766f3433fbb2b0c996430ad1f1488bd47
                            • Opcode Fuzzy Hash: b33891706014834bae6f66e7f3b9f1509c86146735c56852f61a9bbf6d09b47d
                            • Instruction Fuzzy Hash: F2B18E706003019FD705EF28D89499ABBF2FF8921171586A9E44A8F7A6DB30FD49CBD1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 31af2c74f334bea306b2913bf23f573740a20cbdf5d711b0b07a53efbed27df2
                            • Instruction ID: 24a5e593a56d0d21e5e95ce332b4848db160caf0bea99f4da9c3b78f94da8fdd
                            • Opcode Fuzzy Hash: 31af2c74f334bea306b2913bf23f573740a20cbdf5d711b0b07a53efbed27df2
                            • Instruction Fuzzy Hash: 5791B4707003159FEB04AB69D8646EE7BF6FFC8210F148529E4869B354DF75AC0A8BD2
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 0b3368a6b64eb0d55dcccbe9857979a682c78032e78c1dc53ac7c82f6bdaf79e
                            • Instruction ID: 6e6d924035c1414e8bced1bfd776c44c83105af84172d1bcd70ad34ceb052705
                            • Opcode Fuzzy Hash: 0b3368a6b64eb0d55dcccbe9857979a682c78032e78c1dc53ac7c82f6bdaf79e
                            • Instruction Fuzzy Hash: 8C718F70700200DFD718AF39D858A6A7BEAAFCA615B1940AEE406CB3B1CF75DC05CB91
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 700ba1f5831e56d8ccae69ac03264232aa82161c0111346631a69ca410dfa36a
                            • Instruction ID: e9e6e18cda3871fa4bf9d60cac91900fef117d0ffb560ea0c60afbca5e474d82
                            • Opcode Fuzzy Hash: 700ba1f5831e56d8ccae69ac03264232aa82161c0111346631a69ca410dfa36a
                            • Instruction Fuzzy Hash: 2EA15C746003019FD705EF28D59499ABBF2FF892117118AA9E84A8F766DB30FC49CB91
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 39ea3d448fd8566cc8c3ef2438a7897458af1f2b235d386142b061c66cc01d78
                            • Instruction ID: 297fc8a173e3e2170851fe079b38d50adefac23e752fac091ee71f2726eccae9
                            • Opcode Fuzzy Hash: 39ea3d448fd8566cc8c3ef2438a7897458af1f2b235d386142b061c66cc01d78
                            • Instruction Fuzzy Hash: 8C81E1703052059FD305EF69D814BAB77EAEBC5310F20C22AE55A9B3D4DF79AC098791
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 26658ce76509efb93dbdddff1e8b7b1b2115bee99a30aa6710c184655221a383
                            • Instruction ID: 5189cd684316670422c8d9000e80f8d0e64733b1b6d4d9e09e16e7da338058a0
                            • Opcode Fuzzy Hash: 26658ce76509efb93dbdddff1e8b7b1b2115bee99a30aa6710c184655221a383
                            • Instruction Fuzzy Hash: CD81A4B5B002099FCB04EF69D5409AEB7B6FB88300B108265D91ADB359DB34EC56CBD1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 459572563b3d707e9ce4336bea591c0ef7df27c7cd1aeed874744233e75576fe
                            • Instruction ID: 9332b771830130dedcc455d1f34d0defec4f9400a245d3bc4e91b419e5edbefd
                            • Opcode Fuzzy Hash: 459572563b3d707e9ce4336bea591c0ef7df27c7cd1aeed874744233e75576fe
                            • Instruction Fuzzy Hash: 0981A9357012098BD314BF69D414BAE76A6FBC8714F20C129D81AAB388DF7D9C4A8BC1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 50bb1e6f915c97b8af22766681249aaaa415076a34aa3973cb6459ded44dfa04
                            • Instruction ID: 36c65932657ead0dd107dc6c1d1e06073c83018091cec819177b8d8aabb93893
                            • Opcode Fuzzy Hash: 50bb1e6f915c97b8af22766681249aaaa415076a34aa3973cb6459ded44dfa04
                            • Instruction Fuzzy Hash: 4171B071B002459FDB05DF68D844AAEBBB6FFC9210B15819AE506DB3A1CB34DC16CBA1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 87a353b1165f8b28bf6daf325bff6c5001acbe4f295fbcb9fa10321ca5603c4d
                            • Instruction ID: ea26e9f17df88e3b91615a96c4d96e922f1933b9a8a9265031e116611641a3cd
                            • Opcode Fuzzy Hash: 87a353b1165f8b28bf6daf325bff6c5001acbe4f295fbcb9fa10321ca5603c4d
                            • Instruction Fuzzy Hash: 5481A2B0A00216CFDB25DFA5D8546AEBBB2FF84310F60852AD85697394DF38EC52DB40
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: aeef8c139ef2e2c3c0b75daabb12571786e2ad5f3954e2adb74f087ea1d3ea86
                            • Instruction ID: 15e5875bc46cf7ffebf1911225f1095f2a7d5b7f917e7a3ae4deadc450f0c9d5
                            • Opcode Fuzzy Hash: aeef8c139ef2e2c3c0b75daabb12571786e2ad5f3954e2adb74f087ea1d3ea86
                            • Instruction Fuzzy Hash: C08199357012098FD314BF69D464B6E76A6FBC8704F20C529D81AAB388DF7D9C4A8BC1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 7bcde522c12b87a5aff5ef2e92aa9d7a3f989ca2dec4484e1ad727eb8b750f58
                            • Instruction ID: c61f39400d9f4025d65a377ce87ac56c86222cc25e232c68d031abf08e562a4e
                            • Opcode Fuzzy Hash: 7bcde522c12b87a5aff5ef2e92aa9d7a3f989ca2dec4484e1ad727eb8b750f58
                            • Instruction Fuzzy Hash: 9B8151B5B011099FCB04EF68D4949AEBBF6FF88310F248129D946A7754DF39AC06CB90
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 8953e453d71e1987b15bc1146a7d6c533541b27db4fdaa2d61cbefd50170a2cd
                            • Instruction ID: 99b465bc021b4964989ab6680a93249a784d3797a079845aaecdd80329e3e993
                            • Opcode Fuzzy Hash: 8953e453d71e1987b15bc1146a7d6c533541b27db4fdaa2d61cbefd50170a2cd
                            • Instruction Fuzzy Hash: B581B0B0600326CFDB20DF29C5486ABBBF2FF84605F508A2AD806C7751DB34E956CB91
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: ce3c25a3ee8455fd3241420092797f17c8766d85ab3af7c891bea167eca3709a
                            • Instruction ID: 142797d1115a3f9f449b7d83b0ae413328c8b88debd0e6a1b84da2199ab2444e
                            • Opcode Fuzzy Hash: ce3c25a3ee8455fd3241420092797f17c8766d85ab3af7c891bea167eca3709a
                            • Instruction Fuzzy Hash: FA51EAF2B052069FC714CA79DC409ABBBEAEFC5720B18856AF656C7750DA31D80187A0
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: cff63dfa8147510f6230b72b2f4bd78f5f628366b94aaaa5afd002de4dc57ee0
                            • Instruction ID: a39e4e19bb0db2ee848b2e85bf2b9168c31310814d37c11a896b46312f413be4
                            • Opcode Fuzzy Hash: cff63dfa8147510f6230b72b2f4bd78f5f628366b94aaaa5afd002de4dc57ee0
                            • Instruction Fuzzy Hash: 2961D2313012059FD304EF69D855BAB77AAFBC5710F20C229E55A9B3D8CF79AC098791
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 1b5f38825ecd1079a064d52fa333ed4a2be192dc5b9157b4ddfc521ee972074a
                            • Instruction ID: 57d9bf7efe21a39c8c76c195192e813b673b8a9668802f4b00f32fb5fd1aec8e
                            • Opcode Fuzzy Hash: 1b5f38825ecd1079a064d52fa333ed4a2be192dc5b9157b4ddfc521ee972074a
                            • Instruction Fuzzy Hash: 3D714F75B01209DFDB10EFB8D4555ADBBF6FB95300B148129D806AB354EB39AC0ACF91
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 0b5d0d71e75e060a57f0dbd1716dd158a97e78af1bd8e7177dbff173b05a66f2
                            • Instruction ID: 6286cefb5433ee0b81586f60cd558ae0e04768e11456c8d480bd9333f8fde0c9
                            • Opcode Fuzzy Hash: 0b5d0d71e75e060a57f0dbd1716dd158a97e78af1bd8e7177dbff173b05a66f2
                            • Instruction Fuzzy Hash: 7471A0B0B003118FD715DF24C488A9ABBF2FF85310B4585AAD84A9F362CB30ED46DB90
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 08a645d1f14bd54e8a846e8bead8e3f66522eabdbd6272960a6c4472d97672a6
                            • Instruction ID: e73c4c401800dd4f975ee82936068ad0ed620a96b584b6a9eb129e0cbaa5c607
                            • Opcode Fuzzy Hash: 08a645d1f14bd54e8a846e8bead8e3f66522eabdbd6272960a6c4472d97672a6
                            • Instruction Fuzzy Hash: 996161B4B002169FEB14DF69C554AAEBBF6BFC8600B18816AD905EB354DB70DC06CBD1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: e34f693b196040309b7d909fde17c619ba970ee68eb3ca51fad0a55b2cf59a43
                            • Instruction ID: a928a31a02ad21a9b19a67f5ae62bd8a744abbf86881601facd8194c105d2c14
                            • Opcode Fuzzy Hash: e34f693b196040309b7d909fde17c619ba970ee68eb3ca51fad0a55b2cf59a43
                            • Instruction Fuzzy Hash: 6771F6B5E002698FDB54CFA9C484ADEBBF6FF89310F14406AE919E7355E7309812CB90
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 559ffce4d3f30ca2851dffefdf65746fd731d878d0761db8126ce13e50ebc77d
                            • Instruction ID: 1e28a9c642b92861ea16396ad2da434164f6acb10d75e43db265326c1c47bf51
                            • Opcode Fuzzy Hash: 559ffce4d3f30ca2851dffefdf65746fd731d878d0761db8126ce13e50ebc77d
                            • Instruction Fuzzy Hash: A1519274B002159FDB04AF65D8586AEBBBAFFC8310F148029E84AD7394DF799C16CB91
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 4441e3e3e37dab384cb52b6cba4ec0d34ee5e4de185f5315a1b577c3712a80e9
                            • Instruction ID: 5c22abe5a5cb12377344777a2dd2f88978bbdd28e178d37942c1e7aa959d58d2
                            • Opcode Fuzzy Hash: 4441e3e3e37dab384cb52b6cba4ec0d34ee5e4de185f5315a1b577c3712a80e9
                            • Instruction Fuzzy Hash: 94616DB5A00216CFDB14EF64D448AAEB7B5FF88711F5080AAE806E7354DB30ED56DB90
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: da625948fcd1a3018897278069795619e91ef0a6cef92b013122eac84bf69a46
                            • Instruction ID: fa6a7c5732447e3dcdd1c1dbdfe6484d130b7bbac744824f63355b5334c3023e
                            • Opcode Fuzzy Hash: da625948fcd1a3018897278069795619e91ef0a6cef92b013122eac84bf69a46
                            • Instruction Fuzzy Hash: 135190B06012059FE708EF75D858A6EBBE6EFC8300B04C168D90A9B365DF75AC49CBD1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 8b6335127350c4f421f88a3a939e2144b84f83d53885923ad9b837e727f99753
                            • Instruction ID: c5cbd96b469633d16c0d2220be203b533a8abe0cf999e2278fc1436d677272a4
                            • Opcode Fuzzy Hash: 8b6335127350c4f421f88a3a939e2144b84f83d53885923ad9b837e727f99753
                            • Instruction Fuzzy Hash: D87169B0A00306DFDB15DF68C484A9ABBF1BF89300F64C5AAD4599B362D771EC56CB90
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 9b18f0b3f4e00e6e91ecf68fa59576268d0fc44ddda1eaaa6c56dddbf5275d21
                            • Instruction ID: 55547be04843d137b2c204d436591d59f8d7d6b71159cfcb31d0048596ad7808
                            • Opcode Fuzzy Hash: 9b18f0b3f4e00e6e91ecf68fa59576268d0fc44ddda1eaaa6c56dddbf5275d21
                            • Instruction Fuzzy Hash: 7D51B3B0600326CFDB20DF69C548AABBBF2FF84600F45866AD806C7751D734E956CB91
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: c632fbe53b28bf5cfbd3db00487bbf93e4383514b08466c42d877ac3be85e30f
                            • Instruction ID: 9dcdfe8c9b320eca6b3639ae09381758b1dbc65a3ec10546754c9b1b80bd9de1
                            • Opcode Fuzzy Hash: c632fbe53b28bf5cfbd3db00487bbf93e4383514b08466c42d877ac3be85e30f
                            • Instruction Fuzzy Hash: 8C517FB06012059FE708EF75D858A6EBBE6EFC8300B04C168D90A9B365DF75AC49CBD1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 5826f8a83a4fb7de0a707db0b8873c559eaf23fbc5b75a4f8bdd03ff024096cf
                            • Instruction ID: 1479c46f3454b718ba96cab5d41f688a5dee1c64e5a8bd5a807378c1d99be42f
                            • Opcode Fuzzy Hash: 5826f8a83a4fb7de0a707db0b8873c559eaf23fbc5b75a4f8bdd03ff024096cf
                            • Instruction Fuzzy Hash: 9B51F3F1B00756AFDB25DB24C844AD7BBF2EF85311B5488AAD41687752C730E856CF90
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: fd28705de4dfb6a18b2818bd234a479a2317ad724f99480ea8fb3bde50ad4d5a
                            • Instruction ID: c6594398f60e19c6b496fe6f512c9e673740eb6dcd7cdd4c9e8ba7cf644e9e96
                            • Opcode Fuzzy Hash: fd28705de4dfb6a18b2818bd234a479a2317ad724f99480ea8fb3bde50ad4d5a
                            • Instruction Fuzzy Hash: 4151BF75B012158FCB10DF69D8809DABBF6FF89210B1485AAD919DB321DB30EC56CB90
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 3dd339748d14d66284936835664f198b2bc2750b5627e692d9c88639e9b93ffd
                            • Instruction ID: b5cbaaa2382fd222a503725fca57e355fbb3f36189ba3ccfb7004ee29829ce3f
                            • Opcode Fuzzy Hash: 3dd339748d14d66284936835664f198b2bc2750b5627e692d9c88639e9b93ffd
                            • Instruction Fuzzy Hash: 6A5190312043019FE316AB34D46469A7BE6FFC5601B058A6DD48B8F691DF35AC0ACBD2
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 8850073f11ad756e89219e95bb07fb10ecb4830c538d6209d320aedbfe547cb7
                            • Instruction ID: a9baa5c42536fd9af369725672f6d496208edee65c0c524bcbd03bada90c854e
                            • Opcode Fuzzy Hash: 8850073f11ad756e89219e95bb07fb10ecb4830c538d6209d320aedbfe547cb7
                            • Instruction Fuzzy Hash: 2A41ADF0B086229BD7244A3584007A7B7E6AF85715FA4486BD943C2681DB74F863EF61
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 2dbce25128cdcf08fdefffc5858419001a7c80b22efcbd60da200fe37e57fbd2
                            • Instruction ID: 58f7c70316fe31219424e8351641d6bccec490b2c8f9be4dee9a305b16f11247
                            • Opcode Fuzzy Hash: 2dbce25128cdcf08fdefffc5858419001a7c80b22efcbd60da200fe37e57fbd2
                            • Instruction Fuzzy Hash: 7E418CB0A00355AFDB15DF68E890ADEBBF6FF84610F50852AE455AB354DF35AC06CB80
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 9ed81e2390bf0b625bd1ac676535ccae4165a67cc9427b10ee292f763619b368
                            • Instruction ID: b5d02f56f39d42cfc0e652e26c3aa3f183ba26f15873684bb047fd9a21e1af20
                            • Opcode Fuzzy Hash: 9ed81e2390bf0b625bd1ac676535ccae4165a67cc9427b10ee292f763619b368
                            • Instruction Fuzzy Hash: 3E4115757006128FCB16DF69D9809ABBBB6FFC5210B1584A7EA08CB311DA30EC13D7A1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: b8e82be4133e5736bfd8f3d24560f74ccecd3864301a32a66c5c8e98db26dfb9
                            • Instruction ID: 668ae3d7577206ea834e2f18e087d16dff1939010dfc293afeaa910072a8c329
                            • Opcode Fuzzy Hash: b8e82be4133e5736bfd8f3d24560f74ccecd3864301a32a66c5c8e98db26dfb9
                            • Instruction Fuzzy Hash: 9D41B1757011049FCB44FF69E455AAE7BB6FBD8300B108129ED06A7344DE3DAC099B91
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: ca5cbfd46b53490608cb06a8035a2d16025f180e9c2a51c78b287ea0c395d566
                            • Instruction ID: af73e78d39e160fa32298736a219f5f3b2cf79bb615b82320cdeab1ecee9cae1
                            • Opcode Fuzzy Hash: ca5cbfd46b53490608cb06a8035a2d16025f180e9c2a51c78b287ea0c395d566
                            • Instruction Fuzzy Hash: 1141B075701105AFCB44FF69E455AAE7BB2FBD8300B108129ED06A7344EF3DAC0A9B91
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 9f85d45750b7c3bb2e55a9c11495eaa62e11c4547d79585418123c37ad755062
                            • Instruction ID: dda74da02e9e1994b426afa116e1b246eeecb0f93592fde6c73c19f469fb1b04
                            • Opcode Fuzzy Hash: 9f85d45750b7c3bb2e55a9c11495eaa62e11c4547d79585418123c37ad755062
                            • Instruction Fuzzy Hash: 7F3126B23042A1AFEB258B6CA5846EBB795EF88261B548077E609CF711C632DC13D390
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: daf2bedf8fb3c4fad1998ebf3ed93682c755386adc4ab5d608e738e0c0bfe32c
                            • Instruction ID: ccaeeadc3ceb03433359b16d3fe1404e750dbb0f93e93c7843f1c7119b9c082b
                            • Opcode Fuzzy Hash: daf2bedf8fb3c4fad1998ebf3ed93682c755386adc4ab5d608e738e0c0bfe32c
                            • Instruction Fuzzy Hash: 4C41F875B012199BDB05EF78D45469E7BB2FFC5300F108029E906AB344DB78AC4A8BD1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 389eaae24063c9f0c5d223d5fb0a98baa46798932a859cba223334226a93de4c
                            • Instruction ID: 5b6880c37004dc6f61ca81061d82267052b32a1752c429c681c9707274ddf9af
                            • Opcode Fuzzy Hash: 389eaae24063c9f0c5d223d5fb0a98baa46798932a859cba223334226a93de4c
                            • Instruction Fuzzy Hash: 3F4160B02007015FE315EB24D950B9A7BE6FFC1610F40DA6DD18A8FA95DB70B9488BD6
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 6a9be5424e0f8ec1a25d4340dafa80e87972adb607be423f6dd2454338e53b2f
                            • Instruction ID: 31fe6db96b6b4d9b20570c8011527ea996bc310887d0fa95ab47c61c96fc6362
                            • Opcode Fuzzy Hash: 6a9be5424e0f8ec1a25d4340dafa80e87972adb607be423f6dd2454338e53b2f
                            • Instruction Fuzzy Hash: E04144B47006158FCB09CF69C489AAABFF5FF48714B1480AAE506CB362CB75E941CB90
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: fe754105b89aa36a79e66d71ffffdd741adb0afe3df307ff68b578e563ae992b
                            • Instruction ID: c2840e5a7c2f2885b6f33b400d5586eaa317985df3d5650e14a2209661a4d19a
                            • Opcode Fuzzy Hash: fe754105b89aa36a79e66d71ffffdd741adb0afe3df307ff68b578e563ae992b
                            • Instruction Fuzzy Hash: 9641B1B1B1020A9FDB18DF79C8546BEBBF6BF89210B144569D94AC7392EB34DC01C791
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 85f00e0f816b8b8bc1254feeaaf5ad39e20327a6c089fafde4e786afecee3dc7
                            • Instruction ID: af50ea549709ebc460431475fadb43fa38b0a1e64a8277df146b4ec0bea1469a
                            • Opcode Fuzzy Hash: 85f00e0f816b8b8bc1254feeaaf5ad39e20327a6c089fafde4e786afecee3dc7
                            • Instruction Fuzzy Hash: 9A31A0B1B003169FEB11DB79C840BABB7E2AFC4210F10852AD6159B754EB30E912CBD1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 73f3ba7034d070267a75325549517bc403e3603873a0ba6758d2890043768af0
                            • Instruction ID: be8f39c935173c74cda381622825d0c5a814cfa3dec321bd0d056e4ce4a5251c
                            • Opcode Fuzzy Hash: 73f3ba7034d070267a75325549517bc403e3603873a0ba6758d2890043768af0
                            • Instruction Fuzzy Hash: 73311975B002098FDB45DBA8C490EDDBBB2BF88620F156554E906AF361CB71EC458BA1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 8c7d95f9c7bf5e31dfe3e6171d661f35028d46bfd7d5e482742a8a0679d874ed
                            • Instruction ID: c5110da514c685e8da14c0cf6f3dcc7881ea1fbd480cb48d4bade58118430574
                            • Opcode Fuzzy Hash: 8c7d95f9c7bf5e31dfe3e6171d661f35028d46bfd7d5e482742a8a0679d874ed
                            • Instruction Fuzzy Hash: D4311975B002098FDB45EBA8C490EDDBBB2BFC8620F156554E905AF361CB71EC458BA1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: ec16969ebb61a63184e869249f1c8f16a1ac47d70db209cfda75a5bbcd79aae9
                            • Instruction ID: 2603dfdde401e42d9c7fe149428666221aec1dc5ba8ecc60fc63c3b48a8bc413
                            • Opcode Fuzzy Hash: ec16969ebb61a63184e869249f1c8f16a1ac47d70db209cfda75a5bbcd79aae9
                            • Instruction Fuzzy Hash: B4419FB1A00305DFDB14DF64D480AAEBBB2FF89310F54856AE9199B361CB70ED56CB90
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: e872ea6f17269bbe68fb26eadbbfcb5c00669175f0931e689d12bd44600b95b1
                            • Instruction ID: 1f2fa2b1fec0b2eb659fbf34f2d488559100582f834c37513aa8513df520425c
                            • Opcode Fuzzy Hash: e872ea6f17269bbe68fb26eadbbfcb5c00669175f0931e689d12bd44600b95b1
                            • Instruction Fuzzy Hash: 37316675700215DFCB05DF34C984AAA7BF6FF89200B148469E906CB355DB30ED06CB90
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 6e2578f9c1b08e9b28cf6c7fa1a95d569f27288da9274c3e17b040c3a5103590
                            • Instruction ID: e42d017fdd76b382d10473bb8a7520d590c42c878bae455f0896a1c0b618c1de
                            • Opcode Fuzzy Hash: 6e2578f9c1b08e9b28cf6c7fa1a95d569f27288da9274c3e17b040c3a5103590
                            • Instruction Fuzzy Hash: D931D270A023058FDB41EB38D440A9E7BA6EFC2616F148669C5058F252EB75AE0BCBC1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: ca09911ddbf15a3ae634fca361e01dc6efb4915bcccec655add789b863985479
                            • Instruction ID: 30ff72ac43666b59a32034b5a8040b1d7216c3a912738d0fc9308e252091acd8
                            • Opcode Fuzzy Hash: ca09911ddbf15a3ae634fca361e01dc6efb4915bcccec655add789b863985479
                            • Instruction Fuzzy Hash: C231B1B13041118FD705DF3AC598AAA7BE6EFCD65071901AAEA06CB371CE30DC42C7A0
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 34f4a06b439c0efefcf1a08c8faeff540a63f6c27cbf3fbcd9490da1c8dad5bf
                            • Instruction ID: 42b75807fac1c6c8964f06e2f545425840761912eb37aca97267d175da9e7973
                            • Opcode Fuzzy Hash: 34f4a06b439c0efefcf1a08c8faeff540a63f6c27cbf3fbcd9490da1c8dad5bf
                            • Instruction Fuzzy Hash: FF3138306053854FD7269B38C4502AEBBF6EF86221B0848EFC589CB352EA359C45CB92
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: aecb0dec8821be5ee71c2eca3c08cfd363a81bb44bd97be5ebbda7d625d81cf2
                            • Instruction ID: 44be486734a9323f837634f1a362fcbe30f5e51d690e1652e90715c3d6396009
                            • Opcode Fuzzy Hash: aecb0dec8821be5ee71c2eca3c08cfd363a81bb44bd97be5ebbda7d625d81cf2
                            • Instruction Fuzzy Hash: 2C31B1B5A102159FCB08EF65C8505BEBBB6FF88210B14416AD94ADB362EB30DD05CBD1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 679a07e6c2e6fa048a7a45ee7aba48e2d10d5ee670cb38fcd9bc03c384cc60b1
                            • Instruction ID: 0c3bc1246e99ce258c06c98ef797aecd9df8d24717a7fe2a0c9f120b6e221d5b
                            • Opcode Fuzzy Hash: 679a07e6c2e6fa048a7a45ee7aba48e2d10d5ee670cb38fcd9bc03c384cc60b1
                            • Instruction Fuzzy Hash: E431BF707146508FCB05DB78C858BA97FF2AF89710F15809EE106DB3A2CB669C06CB91
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: baaf726f757246e2a27f9eddca74a1a89d7eddde1cca57ed47d51277986c212a
                            • Instruction ID: e354a5023b6b97e66bc9d024f700f0e68acca84bbf9ca7d6b04b06a4c8d5f2bd
                            • Opcode Fuzzy Hash: baaf726f757246e2a27f9eddca74a1a89d7eddde1cca57ed47d51277986c212a
                            • Instruction Fuzzy Hash: EA31D2317052059FD714DB78D854AAEBBB6FFC9210F10806AE54A8B3A0CF369D56CB90
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: d8e5fad78d16dea7082a4542837d329f27484e8b53b8e55adcaad0ea833ff653
                            • Instruction ID: 3cefc50732055a35c1fe2170b3ad8a2ea227da2a049495070899f6dd3940268c
                            • Opcode Fuzzy Hash: d8e5fad78d16dea7082a4542837d329f27484e8b53b8e55adcaad0ea833ff653
                            • Instruction Fuzzy Hash: C6216BB13003016BF708A636DC617BE2697FBC0550F088A2CED468F6D4DE71AD0A87D5
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: c6af31c1684b22169aa8d138a7e4f6e08a85c6d15a360295f6b6a6458c8aa9c0
                            • Instruction ID: 76ca8af9f469517e988fcacaf25bb6913c66c2b9fa98fd04e9390fec98ac17d4
                            • Opcode Fuzzy Hash: c6af31c1684b22169aa8d138a7e4f6e08a85c6d15a360295f6b6a6458c8aa9c0
                            • Instruction Fuzzy Hash: 33319CB5D042299FDB14CFA9D841AEEBFF1AF08320F60411AE411E7391D7349A42DF90
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 3ad87742814dcc2c681da8ab0e10cbd21943f3873e11ff259817c66e8f7249f8
                            • Instruction ID: 2f9bf9a332fcc978687906d1a1918e4552ea4b8adf32aadff7801460cc3fb4fc
                            • Opcode Fuzzy Hash: 3ad87742814dcc2c681da8ab0e10cbd21943f3873e11ff259817c66e8f7249f8
                            • Instruction Fuzzy Hash: 9D2154B33082764FE711CBAAE8446EBF7E5EBC4230B188137E404CB290D7359822D3A0
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: e77824eb8835dc095a54023b6cc5b5ddac596394af97e339e89e677caa1f4e10
                            • Instruction ID: 08dbf811e83525286f27696c0238afbfbc7860326338b8246270a8aa82ac3219
                            • Opcode Fuzzy Hash: e77824eb8835dc095a54023b6cc5b5ddac596394af97e339e89e677caa1f4e10
                            • Instruction Fuzzy Hash: 37213CB13003026BE718AA369C617BE2697FBC0551F488A28ED468F6D4DE71AD0A87D5
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 144cce349a4781a3941c824eb5cc7ace860aaf0073148a892c89b2252f481839
                            • Instruction ID: 5f6eb853cef2d65dec01ba5b3f0c13044d57231b86e254268b33920eda87741c
                            • Opcode Fuzzy Hash: 144cce349a4781a3941c824eb5cc7ace860aaf0073148a892c89b2252f481839
                            • Instruction Fuzzy Hash: 2211D6723042218FD7152B39B8441AABBAFEFC1226314407FE41ACB292CF35D843D7A5
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 2e10d35bf1b5ad44d4ced81029d17a0d1d92e3cf22843d6aa5df4d1fec87d322
                            • Instruction ID: 43e9d59a9de9e09d1e4ad1632f37f0d0ee4946e5100a26b60d166b5254e0a7a6
                            • Opcode Fuzzy Hash: 2e10d35bf1b5ad44d4ced81029d17a0d1d92e3cf22843d6aa5df4d1fec87d322
                            • Instruction Fuzzy Hash: 75318C7160021ACFC764DF68D584AAA77F5FF89310B6444AAE806DB361C730EC52DB60
                            Memory Dump Source
                            • Source File: 00000000.00000002.3837573355.000000000106D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0106D000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_106d000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: cccfabaca32cb2d40b537f3086e2b01fe7177b206b1b1011721387d60b4eb74f
                            • Instruction ID: 9f7ba732c5c126d0c2108482c944d3d7c14614f19a85f059a5569098b98f035a
                            • Opcode Fuzzy Hash: cccfabaca32cb2d40b537f3086e2b01fe7177b206b1b1011721387d60b4eb74f
                            • Instruction Fuzzy Hash: 12212871604340DFDB05DF54D8C0B56BFA9FB84324F20C5A9E9890B247C736E856C7A2
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: a8d527fa06eeed02ea3d6b3928fa377d2c53454474e48cf5c95103d78eeff475
                            • Instruction ID: 6bd9bae8e9f8b3ebecde59c354b5e0ff14baa6983916c6e3cfe551bf6bbf97ca
                            • Opcode Fuzzy Hash: a8d527fa06eeed02ea3d6b3928fa377d2c53454474e48cf5c95103d78eeff475
                            • Instruction Fuzzy Hash: 092126712043558FE711AF69D8543DE7BE6FFC5611F14452BE0468B382EB709C0A83E6
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: b27ac8905547debaabe04c177bf2f9aa7ff58bab2ad329d11782ce2ed3975c72
                            • Instruction ID: b93d1a7e322d1698a123667f62091d3c64fe526b2f872b536233af850f5b7a6d
                            • Opcode Fuzzy Hash: b27ac8905547debaabe04c177bf2f9aa7ff58bab2ad329d11782ce2ed3975c72
                            • Instruction Fuzzy Hash: F5218E712053409FD3259F24D494E567FF6EF86320B1581AAE8868F2A2CB75ED45CB90
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 268aec9ea0d7914cb8720b49dbcec8ceafed01867b95186149a111ef689f79df
                            • Instruction ID: 9057568915098e65fb46cef7910a27c1bd4fccb884e5de997938182da68022f8
                            • Opcode Fuzzy Hash: 268aec9ea0d7914cb8720b49dbcec8ceafed01867b95186149a111ef689f79df
                            • Instruction Fuzzy Hash: 6221A1B53041228FD3159F29D484A9A7BE6EFC531071981BBEA05CB365CB31DC56D790
                            Memory Dump Source
                            • Source File: 00000000.00000002.3837597769.000000000107D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0107D000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_107d000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: ea5affc011f71949fda9d59be28905ce46b66bc211295549ba9e6ede81a166ec
                            • Instruction ID: 7b4d9a42455f0f7d21fdb714ecc6ac732efd83f192242f697d6143b7054b5023
                            • Opcode Fuzzy Hash: ea5affc011f71949fda9d59be28905ce46b66bc211295549ba9e6ede81a166ec
                            • Instruction Fuzzy Hash: 84212575A04304AFDB05DF54E984B26BBA1FF84324F20C5ADD8894B242C336D446CB61
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: fd7ce4307ae27642d9c6d4d02bfed4e08f7ff6bc185dfb02c500adbf3e3a15ec
                            • Instruction ID: b1706ad6f9ea3526f4c077f4d24a313e5aabd8c3ec1ce80f76a58c534ebac96c
                            • Opcode Fuzzy Hash: fd7ce4307ae27642d9c6d4d02bfed4e08f7ff6bc185dfb02c500adbf3e3a15ec
                            • Instruction Fuzzy Hash: 9121C771A0024A8FDB25DF68D8087DEBBB5FF88310F24812AE442A7294EF345809DF90
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 67a1457f639bb3d6b519b31900d480bb166f79601f1bb80e8085b49788eeaa80
                            • Instruction ID: 57e4215816122fddbcdb1ec3e2c2ca876dec354bae2a72f25b73ef41a48e2e0c
                            • Opcode Fuzzy Hash: 67a1457f639bb3d6b519b31900d480bb166f79601f1bb80e8085b49788eeaa80
                            • Instruction Fuzzy Hash: 2E21CF35A00248AFDF11CFA0D884ADEBFB6FF85710F00845AE911AB395C7359856CB90
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 02663628e2c1c2e836627a72f9577672de1c37177e7bc12180907398adcd9f8c
                            • Instruction ID: 971866ae4d9266c8453980b922f4cdac049dff58fde5957322173f679751b8c3
                            • Opcode Fuzzy Hash: 02663628e2c1c2e836627a72f9577672de1c37177e7bc12180907398adcd9f8c
                            • Instruction Fuzzy Hash: C021EB71F002094FE7049B69C454BAEBAEBAFC8710F18405AE502FB395CEB49C41CBD0
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 83dad4fcfa37715882a1bdee01107e45e9f65062ffc17000f47192bb6234bf7e
                            • Instruction ID: 1333750964204689f2454e3873a1fbe8e8015e497c6313881ea09e3bc776d679
                            • Opcode Fuzzy Hash: 83dad4fcfa37715882a1bdee01107e45e9f65062ffc17000f47192bb6234bf7e
                            • Instruction Fuzzy Hash: 31218EB2A00205DFDB04CF7AD944AADBBF5FF48310F148169D402A7361CB759D45CB90
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 9bdafefed6caa4a4f62fe06a050d2b4cabd519e08913fd408c103df755472813
                            • Instruction ID: 1bc3fa9e34c2a85ead1bcc384667b8c4790c35e9bdd99e89636d63118519f650
                            • Opcode Fuzzy Hash: 9bdafefed6caa4a4f62fe06a050d2b4cabd519e08913fd408c103df755472813
                            • Instruction Fuzzy Hash: 3C2127B1A0021ADFDB14DF6AD948BADBBF1BF88310F108069D502A73A1CB759D45CBA0
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 3a31fdb3b2babc145cf9429202f5047b2c383a310fbcf24b3d1d59dc75676ce3
                            • Instruction ID: aaec5094b804b5656e7d00e8523c5b9740a5d2d53545813b3a04e6da8c3339b5
                            • Opcode Fuzzy Hash: 3a31fdb3b2babc145cf9429202f5047b2c383a310fbcf24b3d1d59dc75676ce3
                            • Instruction Fuzzy Hash: A121CD756002049FCB04EF69E8548EEBBB6FF98220B11C266E9069B350CB369D09CB91
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 786532e7f5feb2c1211b7f82da4ac3c66f6dbdfc73b9253967fb7683772c175f
                            • Instruction ID: e28e7faf48015cb93aee5d8ce23a715cec3bc06a77530e67e8833eda8891ccfb
                            • Opcode Fuzzy Hash: 786532e7f5feb2c1211b7f82da4ac3c66f6dbdfc73b9253967fb7683772c175f
                            • Instruction Fuzzy Hash: AF216D707105158FDB14DB79C818BAE7BE6AF88B10F204199E102DB3B0CF769C058B91
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 076d7d67ad9391bbe2e4b83377b3323d98d545eb1f6d42579051f9cf21044d5a
                            • Instruction ID: d3986d3a818cd140de575465dd03e2297ad25d80db93cccb8c5a4077b2b7dfe3
                            • Opcode Fuzzy Hash: 076d7d67ad9391bbe2e4b83377b3323d98d545eb1f6d42579051f9cf21044d5a
                            • Instruction Fuzzy Hash: 221170F0F141608BD329252C515A1FBA657E7C6601BE45417D82AC6744DF29CC53EF52
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 1e04883102d51cd0f75fea6501330300e304fa13d411758fc2a2c4d1cf696460
                            • Instruction ID: b05e4190ea584f668472db07321e86193ee1d0f6de1efb85d4d4d24defbe62c6
                            • Opcode Fuzzy Hash: 1e04883102d51cd0f75fea6501330300e304fa13d411758fc2a2c4d1cf696460
                            • Instruction Fuzzy Hash: C2214C75E0021A9FDB04EFA9E950AEDBBF2BF88214F10C165DA15F7350DB3599058BA0
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: fef8f11882154748e896229e9fbfc97508d513318931ca7872ea3999654fd85c
                            • Instruction ID: e324925fba6486bcf0132dc065cd43fe00c04b1d69c0cbf1aa15cff5894d2cbd
                            • Opcode Fuzzy Hash: fef8f11882154748e896229e9fbfc97508d513318931ca7872ea3999654fd85c
                            • Instruction Fuzzy Hash: 3311E1B1700311AFD7258E66E480A53BBA7EF81225B14846ADD4A87712C731E896C790
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 91313a518afc177bfdb55fdb35a61c2eaa46c3e7e92d3d26a297b596d271feb6
                            • Instruction ID: 02525c98b944a2ebcb5ec23871ad6f61433fcbf8af1325ce0df6362430a6443f
                            • Opcode Fuzzy Hash: 91313a518afc177bfdb55fdb35a61c2eaa46c3e7e92d3d26a297b596d271feb6
                            • Instruction Fuzzy Hash: B4118671B001098FE7189B69C454BAEBAEBAFC8710F24802AE505FB394CEB09C45DB91
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: fa3e1ee937f77c96a165416dcf703849f53faeae41ed46ab4447a44eb73a9723
                            • Instruction ID: e0b36ba02d559ea49eec58185e11dc3b82d4f34529f37613e8e43c3877a58637
                            • Opcode Fuzzy Hash: fa3e1ee937f77c96a165416dcf703849f53faeae41ed46ab4447a44eb73a9723
                            • Instruction Fuzzy Hash: 0B119374750205DFDB149F69C494BAEBFA6EF88710F148069E502EB3A5CFB2AC40CB90
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: c5a7c1f8bc629d3d4cf08bc2f92837b261a70e0a40b70365565b2694252c863d
                            • Instruction ID: 19a61b18d87ecca8616943aead8a58a27e240966dbdca7ffcc8506bc36dc3ec2
                            • Opcode Fuzzy Hash: c5a7c1f8bc629d3d4cf08bc2f92837b261a70e0a40b70365565b2694252c863d
                            • Instruction Fuzzy Hash: 2A11C8B6B006205FD325EA7DA840B6BB7E6DBC8661F15413BEA09DB750DE70DC0287D0
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 7e0c0b9dfca51cae1a0deaacd107d5a0b5547b4ac73426560f9fd4c49dcba135
                            • Instruction ID: cf6be1095ea2cd6400a74636e09e851bc4d8b330a3fb9bd155717c22ff4ad862
                            • Opcode Fuzzy Hash: 7e0c0b9dfca51cae1a0deaacd107d5a0b5547b4ac73426560f9fd4c49dcba135
                            • Instruction Fuzzy Hash: CB119072B04115CBCB249BA5D8986EEBBF6AB88321F14002AE44AE3364DF754C56CB94
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 88cbd2deb7f24c8dcd432f19e41d64d281d861007bd7fe4f8338d128614bddab
                            • Instruction ID: d7ba027660d24b4d6982f00a0f57d19e50fc4ccfe33300295ca44231251c3226
                            • Opcode Fuzzy Hash: 88cbd2deb7f24c8dcd432f19e41d64d281d861007bd7fe4f8338d128614bddab
                            • Instruction Fuzzy Hash: 8E11C4717003128FE720EB69E884A6BBBA9FFC5615B14862DE946CB300EB759C01DBD5
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 74de7b60986f024687a2c2115f6a1c86f36562b114244f99f45f37c1eba3c1f1
                            • Instruction ID: 3976a683ecf0b31ec21ae700a20d579c4c6e0316cd54a3d028f5d7f7e17bb92c
                            • Opcode Fuzzy Hash: 74de7b60986f024687a2c2115f6a1c86f36562b114244f99f45f37c1eba3c1f1
                            • Instruction Fuzzy Hash: 7D0126F03082239BD720456B58407AB66CE9BC4601F95C03BAE09C3780DF3CCC5393A5
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: dbf66b01ef710b61f80bfbc7a7afd1acb52ae5198947c51ffb56df53fd5f87fa
                            • Instruction ID: 0b0a204d44a9b0cfe26449b08e57e7baa5ad00ae7b9f8c6891d655bacec7cbb8
                            • Opcode Fuzzy Hash: dbf66b01ef710b61f80bfbc7a7afd1acb52ae5198947c51ffb56df53fd5f87fa
                            • Instruction Fuzzy Hash: BA21D270A013059FDB01EF38D400A9EBBA6FFC1211F108769C5459F246EBB9AE0ACBC1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: f6878e419763cb9f98e2abf3ff9f7fd8c9d8157a2c0f91eb75d9bfd2f3c677a6
                            • Instruction ID: cd8367992b84c6f5ff3483b4ff478e67e36cee3c1707b4b81e0b1534398a6cd6
                            • Opcode Fuzzy Hash: f6878e419763cb9f98e2abf3ff9f7fd8c9d8157a2c0f91eb75d9bfd2f3c677a6
                            • Instruction Fuzzy Hash: A511E3727002189FD704DB69C958BDE7BF6AF89700F24005AE502EB3A1CB759D05DB91
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 16228cf22ebc74404fab8e066a7d1854f55fb7d7249efee9232c67ae0000298d
                            • Instruction ID: 9da6854353e9148f5a39d4a707fef9e4a7bcec73f54717a958c8e101e8ae4b08
                            • Opcode Fuzzy Hash: 16228cf22ebc74404fab8e066a7d1854f55fb7d7249efee9232c67ae0000298d
                            • Instruction Fuzzy Hash: 1111A271200300AFE311EB68D840A9EBBE6FFC1615B14CA2DD5494F690DB71BD0A87E1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 1cc3c3e3555f4c8d50b0d1c791d7bb9b7014df2e4d1b06e327b09e34be1aa0ab
                            • Instruction ID: ef3c6322a70f9e61a3417f4050b330c12bc09f39362c073b239143b88524fc1f
                            • Opcode Fuzzy Hash: 1cc3c3e3555f4c8d50b0d1c791d7bb9b7014df2e4d1b06e327b09e34be1aa0ab
                            • Instruction Fuzzy Hash: D31142B8518488CBC7186FB8E12E6BC7B74BB62246B444155E203C754ADB3F9D06AB62
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 6001b4a68e0c6b8636dc83f3e8441de689a9bf0abcf19fe016e731fe5e39c24f
                            • Instruction ID: 5e1d605c76185a6e39c7d07cb3a8b46be426187c1a93ef618d5fcc0592636d10
                            • Opcode Fuzzy Hash: 6001b4a68e0c6b8636dc83f3e8441de689a9bf0abcf19fe016e731fe5e39c24f
                            • Instruction Fuzzy Hash: EA114274750204DFDB149B69C494BAEBBA6EF88710F145059E902AF3A5CFB19C41CB90
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 998a197b2ac6ca6c3d50024d800a30f1de6b9804e9cfb873f71654c01ae21b87
                            • Instruction ID: d8a763086956f2820b0fed0e550068cb9d5a9fe591cde22183a568697273d266
                            • Opcode Fuzzy Hash: 998a197b2ac6ca6c3d50024d800a30f1de6b9804e9cfb873f71654c01ae21b87
                            • Instruction Fuzzy Hash: 3211C270B05208EFD708EFB4D8116AEBBBBEFC5200F1085BE944A9B255DE319E0597D1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 3a5d7f5e5de66d63791dad96f0f9893d2e8ca96b849c42ba3fb905ec91613b01
                            • Instruction ID: c9bee2b17fd398e89dd4ddbeb8e0adc94f5bde199fe02c36e7e3dd3debdd8671
                            • Opcode Fuzzy Hash: 3a5d7f5e5de66d63791dad96f0f9893d2e8ca96b849c42ba3fb905ec91613b01
                            • Instruction Fuzzy Hash: DD11A172310314AFE714DF98EC44EABBBA9FBC8620F50452AF505CB280DB71E9158BA0
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 8cb63ba6ee171ecff38713d4dd809339ff56c2de23244aca516c330ba09edf8f
                            • Instruction ID: 092f7cc4e83c4439e8a72edd2ed4beb69bc51a3d08e45f13120edf9b36536c63
                            • Opcode Fuzzy Hash: 8cb63ba6ee171ecff38713d4dd809339ff56c2de23244aca516c330ba09edf8f
                            • Instruction Fuzzy Hash: 301125713003149FD720CB68D800FA67BE4EB85711F008267E258CF6A1D7B1E8069390
                            Memory Dump Source
                            • Source File: 00000000.00000002.3837573355.000000000106D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0106D000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_106d000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: e3062b24f5b0128947100ec6e500ced3c6d63245422b7ec3b5033f72fc324263
                            • Instruction ID: 59947d3f22064146e5509e49aa311c3400cd1b5a328edb99b92a9c78b1306b19
                            • Opcode Fuzzy Hash: e3062b24f5b0128947100ec6e500ced3c6d63245422b7ec3b5033f72fc324263
                            • Instruction Fuzzy Hash: C911B176604280CFCB16CF54D5C4B56BFB2FB84324F24C5A9D8890B657C33AE856CBA1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 5225394dd67b421ff4d44797cca6cb5c6e683d82ee687e7dc42d8fb99af3d4b7
                            • Instruction ID: 7146bb848816c0deeafa773d68301d4366c09d692fefbeaec40e333fda877972
                            • Opcode Fuzzy Hash: 5225394dd67b421ff4d44797cca6cb5c6e683d82ee687e7dc42d8fb99af3d4b7
                            • Instruction Fuzzy Hash: 2011CE72700300AFD715CFA4DC49EAB7BA9FB88610F04855AF509CB281DB75ED158BA0
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: ae19db39115e8ca19f01ddcbe5644a00a97d827149a3b0895507a67ed91435d5
                            • Instruction ID: 3db3e5b25dde7fe33b6c84e1da1fb89eee6cab03ba3047d4bd179109d7d8c74a
                            • Opcode Fuzzy Hash: ae19db39115e8ca19f01ddcbe5644a00a97d827149a3b0895507a67ed91435d5
                            • Instruction Fuzzy Hash: 6811A3B4B102159FCB14EB69C840BABBBF6FFC8650F10052AD506DB741EB30AC02C7A1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 0724098a07794d790c75f0cb68ab27215be83d6ab1bf3b39702d86a24fd10f37
                            • Instruction ID: 4b6319173ff9d5f4879d21e60b3972523ca47b84b7a218ca44fe370feec18f49
                            • Opcode Fuzzy Hash: 0724098a07794d790c75f0cb68ab27215be83d6ab1bf3b39702d86a24fd10f37
                            • Instruction Fuzzy Hash: 8A1191B1A053148FEB15DF64C8547DEBBF1FB89301F1045AAE401AB394CB798C05CBA4
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: fa6c532a917dbc6f624ade1ca6a132547dc898f38897ed8a579a66ad77b0f0a8
                            • Instruction ID: f7d1b3e785732ec587029ba87c832ed4f184f8cbe5df11bdcc0d16e6fc613087
                            • Opcode Fuzzy Hash: fa6c532a917dbc6f624ade1ca6a132547dc898f38897ed8a579a66ad77b0f0a8
                            • Instruction Fuzzy Hash: 2111BF302007019FD715EF39E84095ABBE2FFC52157148A2DD45A8B691DB71A90A87C1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3837597769.000000000107D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0107D000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_107d000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
                            • Instruction ID: 25d081f1671237b3e65a41af044278b2d2dd493557efaab86c994a98b98c0402
                            • Opcode Fuzzy Hash: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
                            • Instruction Fuzzy Hash: 8311EE75904280DFDB02CF54D9C4B15BBA2FB84224F24C6A9D8494B252C33AD40ACB61
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 46f555c2372e8bf1f69082a17fb936fdde22920957ecbd545e80de48f4a093ab
                            • Instruction ID: 1f4c5c6987750723f04c8c057ceaa02434b5f53d64e4cbe0260a8763a6027129
                            • Opcode Fuzzy Hash: 46f555c2372e8bf1f69082a17fb936fdde22920957ecbd545e80de48f4a093ab
                            • Instruction Fuzzy Hash: CE11A1B1A11214DBEB14DA64D805BEE77B9FB85311F60446AE401BB280CBB65D05DB90
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: b1c79e03a816ffb3832ccc4a8c8ab2ccc6815737e8bd13f52a70d4acc5029aa6
                            • Instruction ID: bcbeab913bddf9837accbfcf98ab2b055d96d477861995f8b3f24d2815e58c28
                            • Opcode Fuzzy Hash: b1c79e03a816ffb3832ccc4a8c8ab2ccc6815737e8bd13f52a70d4acc5029aa6
                            • Instruction Fuzzy Hash: 1901D8B5704320AFD315DB29D840A6BB7F5EFC8665715416BE908DB350DA30DC02C7E1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: f161dfb4bf20bec654f942c54a4210d3acdfa55f0994c2bea4f505aaf967ec2c
                            • Instruction ID: 57c29b2b34f9188928aa7daaa9dd55897ab142374c84ca0912f52cec3a041bd7
                            • Opcode Fuzzy Hash: f161dfb4bf20bec654f942c54a4210d3acdfa55f0994c2bea4f505aaf967ec2c
                            • Instruction Fuzzy Hash: C9012DB26001599BD709DA7CEC107DD3798EB41165B1443E6E8168B1C1D7315A06A385
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: e569bd28f7a781347c06d8b04dbd27a8de5be1647637fc3d58be6dbe3ff2d9be
                            • Instruction ID: 12325d1a67d6a4ea1e47588f69bdd218260c2652f49cf70b786847a01b4de1c8
                            • Opcode Fuzzy Hash: e569bd28f7a781347c06d8b04dbd27a8de5be1647637fc3d58be6dbe3ff2d9be
                            • Instruction Fuzzy Hash: 4711A0B6D152189FDB04CF95D940AEEBFF2BF88310F24812AE811B7360C7304911DB90
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 54eab9513c26e7be96757f7d0759d9f2721b163798e14343b16d6bd4741fe9a0
                            • Instruction ID: 44a61d4209ca50aa5f145586f5902d135d5d908d700241136be5fdc3ca53f8d7
                            • Opcode Fuzzy Hash: 54eab9513c26e7be96757f7d0759d9f2721b163798e14343b16d6bd4741fe9a0
                            • Instruction Fuzzy Hash: 7D1156716047168FD721DF29E88098B7BF5FFC5611B008B29E8898B665EB70FD098BD1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 47fa2828a5013739b4a56465bbaa72a607a8122cdd2165f3b76915157bed3525
                            • Instruction ID: 0d6c3fe0cfac0ed91fa2c2d67833b4b748fa77d83cb77bf49da16b1234e372ab
                            • Opcode Fuzzy Hash: 47fa2828a5013739b4a56465bbaa72a607a8122cdd2165f3b76915157bed3525
                            • Instruction Fuzzy Hash: 3011AC302007029FD725EF39D84089AFBE6FFC5615314CA2DD45E8B691DB71AD0A8BC1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 7c26eca0d16d31110bd37a610232a1e90afa66ffa264fa1266bbbd51ddff2886
                            • Instruction ID: 1bb8aa2d89edf3540d0e9efba1b36f2f75c36bd7068d27e5b12ea91d87b9d23d
                            • Opcode Fuzzy Hash: 7c26eca0d16d31110bd37a610232a1e90afa66ffa264fa1266bbbd51ddff2886
                            • Instruction Fuzzy Hash: D901B575A01209EFCB20EF68EC459EF7FB4EF89320B100126E91AE3241DB314911DBA1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 468b4b93c4011edb189c45d675ebcbd41daaf95b431ebefa7294c3eaebfe0501
                            • Instruction ID: 5d5e732b911375964c7a627b46951987abf31508585ba7d32e470bcd1915b75d
                            • Opcode Fuzzy Hash: 468b4b93c4011edb189c45d675ebcbd41daaf95b431ebefa7294c3eaebfe0501
                            • Instruction Fuzzy Hash: 3B012BB5B0173ADB8B289BA4994057FB795FFC56A03050229CD0ADB340DF34EC4587D5
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 1ca749bc153d875665381d9ce18f8750b922860c70a92025d90a3112241cec33
                            • Instruction ID: 077041a99be4670607832f138ab3bd66cca60b38f192f37aa59f1331f91c3e45
                            • Opcode Fuzzy Hash: 1ca749bc153d875665381d9ce18f8750b922860c70a92025d90a3112241cec33
                            • Instruction Fuzzy Hash: 0501D2717102189FDB14DB69C958BAE7BF6AF8D700F20006AE502EB3A0CFB19C01CB90
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: a64738faf5b4f50d6a1763d513fd1b04d7de70f0915680fcff9a510f740a4e7c
                            • Instruction ID: 9dbac884d23eb72c560cd79c7a28738a49f4a2c63741c9b176f9cd87cb51b57c
                            • Opcode Fuzzy Hash: a64738faf5b4f50d6a1763d513fd1b04d7de70f0915680fcff9a510f740a4e7c
                            • Instruction Fuzzy Hash: 5601D672A00109AFCB40EF69DC44DFF7BB9EF49320B004066F619D7211EB319D118BA0
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 1ae5865960e3e45163b0950a048eb5d1470ab9c4527f6e50ffca2d32a475f5c5
                            • Instruction ID: 7faafd3dc06a992bbe47fb3f26105f61f63e35ef3011815f53a740d297aa726f
                            • Opcode Fuzzy Hash: 1ae5865960e3e45163b0950a048eb5d1470ab9c4527f6e50ffca2d32a475f5c5
                            • Instruction Fuzzy Hash: DAF0C2B7B0912A3BF710080B8C11BBF794ADBD56B1F194226FE55962D0D67ACC21A2E0
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 8dfe10b22695ba7629438c42e6658713a3458266234f4d9e661f0bef1ce3545e
                            • Instruction ID: a686110eb84a3fd879a5a9d31b9d98e14c7f5ee72c48ede1fd79255db67e15e7
                            • Opcode Fuzzy Hash: 8dfe10b22695ba7629438c42e6658713a3458266234f4d9e661f0bef1ce3545e
                            • Instruction Fuzzy Hash: 61F0C2367092549FDB066778A8184BF7BEBDBC62217148067F506C7382CF2ACC0693A1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: fdcf936a6a5b8f477cf1c0069e5049f2e9236c7059eab03c4284e281a3239656
                            • Instruction ID: 901d8ab227d9845b0646a46c39e7aef15ffbf9adb1399e5defabe91a5849d2fa
                            • Opcode Fuzzy Hash: fdcf936a6a5b8f477cf1c0069e5049f2e9236c7059eab03c4284e281a3239656
                            • Instruction Fuzzy Hash: 2C0184312047054FD721DF29E88098EBFE1FFC4611B008B29E88A8B625EB70ED098BD1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 7cf6caffc30db569d6f1d7bdf7a2a4fce43dc7d1c6cf903372e7c9c0e85ce900
                            • Instruction ID: b53393081e764c70a081688704262ac48d5784ec8a69c5e99c6398d9a1ad9a38
                            • Opcode Fuzzy Hash: 7cf6caffc30db569d6f1d7bdf7a2a4fce43dc7d1c6cf903372e7c9c0e85ce900
                            • Instruction Fuzzy Hash: 7FF0C8B290520CEFC701DFB4A8015EEBFF9DF8A150B0045E7D549DB611EA354B5157E2
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: aeb3b2009e68dbaeecec341201d17561568ef9f723bb8b16d2363410911a20c7
                            • Instruction ID: 718020d8aa16b061297f692ba9abb1b54376f9a4d8ccff5ba05612ca7e99f527
                            • Opcode Fuzzy Hash: aeb3b2009e68dbaeecec341201d17561568ef9f723bb8b16d2363410911a20c7
                            • Instruction Fuzzy Hash: 52015271E012099FCF14AF79D858AEE7BB5EF88310F104529E91BD3241DB354D15DBA1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: cb5f2d49b8272239a2388e8cde3e89e96c19ed66cadc794160187d7cee8228fc
                            • Instruction ID: df7e26a0b62f1b3d9644393b9b8eacfab9318577123c29ba126483fe2a21c0f2
                            • Opcode Fuzzy Hash: cb5f2d49b8272239a2388e8cde3e89e96c19ed66cadc794160187d7cee8228fc
                            • Instruction Fuzzy Hash: 68F0A472304225AF8B14DE9AEC449BFBBAEFBC8230315802BF509C3200DF71D8119790
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 33b84b4defb3c315ea53d8d62f4710e8727c6389a3f75e698b8493b95639b20f
                            • Instruction ID: 3eaba1295e2e3e90c8f2b4e6bd2d164d93769f2d0acc0a6dbbcca60b561e5850
                            • Opcode Fuzzy Hash: 33b84b4defb3c315ea53d8d62f4710e8727c6389a3f75e698b8493b95639b20f
                            • Instruction Fuzzy Hash: 7501D4303023145FEB05EB28E810B8E3796EFC2605F148669D5488F352DB75AD07CBD1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 5923be31e7e0d7fa23a9a2b96a1c3d9379340aacd070368811717d3067e1025a
                            • Instruction ID: fde543a2280084656cc8634ed7b5c9ee49a3e7b5f7655d020a84f56049ede0e6
                            • Opcode Fuzzy Hash: 5923be31e7e0d7fa23a9a2b96a1c3d9379340aacd070368811717d3067e1025a
                            • Instruction Fuzzy Hash: 1BF0C871A012096F8750EA69EC409EFFFF9EB892517004127E50593201DB3059128BE1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 7bd568d49beae7a7cb140c46768c7977f6696ef7b9d1aaba727141b52f3f87d3
                            • Instruction ID: 5fe352862834fdde7efcd9226609daaf9fdf6ab45e315534ff7bc7d0ab288696
                            • Opcode Fuzzy Hash: 7bd568d49beae7a7cb140c46768c7977f6696ef7b9d1aaba727141b52f3f87d3
                            • Instruction Fuzzy Hash: B10112312007158FD724DF29E88098FBBE5FFC46117008629E84A8B625EB70FD098B91
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: ff49e0881a957255d203b218b11dab8a72318502bbef5fe57e7b621dece8d293
                            • Instruction ID: 27e31397541038e9f9e6e7ec050fa688b31f429eacccf5e11a9afc8a620f40d2
                            • Opcode Fuzzy Hash: ff49e0881a957255d203b218b11dab8a72318502bbef5fe57e7b621dece8d293
                            • Instruction Fuzzy Hash: AC016DB5E01219AFDB04CF95D944AEEBFF2AF88310F10802AE801B7350CB315910DBA0
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 9a6e09f271f97956baf4156c70440ec3fbf642406d495aa53a4c99deef0eb6f3
                            • Instruction ID: 921e5bd1cf03ef474cb3946aa054fd1a44f3088da39430c17e7d354a0b6eff72
                            • Opcode Fuzzy Hash: 9a6e09f271f97956baf4156c70440ec3fbf642406d495aa53a4c99deef0eb6f3
                            • Instruction Fuzzy Hash: C80181B0600322CFCB698A75D5046A3B7E6FFC6245B948C7FD40286A24DB71EC52DBA1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: f2ce484fa75931e164c282960a4a647aed430ad50ac413a038e2d50742336c2e
                            • Instruction ID: fee0c6cc154de33f9f95cbea63e3deee6eb1a315e9b11c93df26dba15bffc874
                            • Opcode Fuzzy Hash: f2ce484fa75931e164c282960a4a647aed430ad50ac413a038e2d50742336c2e
                            • Instruction Fuzzy Hash: C6F0B4B7B081266BF711085B5811BFF7A4BDBC4661F094126FE0596281C67ACD51A2E0
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 05efce415ac066b3f6850f7231391a4ace4e32d5adb790a5c491f5ee89a25a47
                            • Instruction ID: 13142428af0c3d057ed2f1793ccea45ba4115ddc3e75fe0f79270ad1825cbe26
                            • Opcode Fuzzy Hash: 05efce415ac066b3f6850f7231391a4ace4e32d5adb790a5c491f5ee89a25a47
                            • Instruction Fuzzy Hash: B6F0F4302023455FDB06EB38E4106DD7BAAAFC2404B104669D4859F296DF7A6E0B87D1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: b6b58f536524dac5f9814d987de8ea1bc436e6cde9a416970a857a353d8edf04
                            • Instruction ID: 76ee63b586150d1601b42337ef85a02e1b161ebbe291e6822d71ac60236ea8d5
                            • Opcode Fuzzy Hash: b6b58f536524dac5f9814d987de8ea1bc436e6cde9a416970a857a353d8edf04
                            • Instruction Fuzzy Hash: 67F0F6311053218FD7218A65A9405F3BBE9FB82118B5489AFD08242E21C675EC43DBA2
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 2ec9de4c6d73d6d94d64d130e188a840a5326d724b9fd714731a1ca91994a040
                            • Instruction ID: 32275057135d43d3d84b5fa70978c78f9dd5c27e2584cd3daf0a1208147ed8d8
                            • Opcode Fuzzy Hash: 2ec9de4c6d73d6d94d64d130e188a840a5326d724b9fd714731a1ca91994a040
                            • Instruction Fuzzy Hash: 81F028303003015FD618FB29E410AAE7BE7AFCA500B04856DD84A8B741EF30ED0A93D2
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: e48911b0f3ed9001487e910da9b764fff3e8a1601c188d63269a698bd8aac130
                            • Instruction ID: 12f58958880eec52f99cdde22e83f7a5d7b7870effa9b0a2425cc98167f6dd9f
                            • Opcode Fuzzy Hash: e48911b0f3ed9001487e910da9b764fff3e8a1601c188d63269a698bd8aac130
                            • Instruction Fuzzy Hash: B0F0E2723082265F8B15DBAAAC449FBBBEDFB89274305402BE018C3201EB31880697A0
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: c8d46b42244e770ecf51ed4ad174e733d12d61f751790093ba741bc5c22dd857
                            • Instruction ID: 5205d13da096e2153ff6b87eb688ddb8863a6b22969a370eabd0ad9e37386d0c
                            • Opcode Fuzzy Hash: c8d46b42244e770ecf51ed4ad174e733d12d61f751790093ba741bc5c22dd857
                            • Instruction Fuzzy Hash: 6F0186303023145FEB05EB39E410A9E379AEFC2616B148669D5098F352DF75AD0ACBD5
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 7c9dddf48d1f90bc431170ebeb4e09d1afd4f566d325caf65e75a4a0d91cfafd
                            • Instruction ID: eabb9eca87b73b3278d8b0f993a467375e358f8c25e15a6c6ddb6c244474fa63
                            • Opcode Fuzzy Hash: 7c9dddf48d1f90bc431170ebeb4e09d1afd4f566d325caf65e75a4a0d91cfafd
                            • Instruction Fuzzy Hash: 45015EB5A11216DFEB00EF65DD80BAD7BB2BF89604F108125DA11B7395DB799804CF60
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: d26c3d7037fd399781004d6c61c1a11bde1ea0de337147f283a283df995b9c6c
                            • Instruction ID: bedfa544e5716205eee59b640f679cc8650e303de0389d502fb1d07ac604db1b
                            • Opcode Fuzzy Hash: d26c3d7037fd399781004d6c61c1a11bde1ea0de337147f283a283df995b9c6c
                            • Instruction Fuzzy Hash: 4FF022313043549FD721CA28EC40FA27FE4AB86724F0482ABE254CB5E2C7B0D8069790
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: cc8c4dface6a9e6a9417dffe9084639f48c53e067c1be02a5712968a4affe5cd
                            • Instruction ID: 4117b8dbf092c3a6042b6841a9886893981f30a9501663920a905237cfff2ef5
                            • Opcode Fuzzy Hash: cc8c4dface6a9e6a9417dffe9084639f48c53e067c1be02a5712968a4affe5cd
                            • Instruction Fuzzy Hash: 76F06DB2A00109AFCB40EFA9DC45DEFBFF9FF89210B54406AF619D7211DA35D9118BA0
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: dd040c53f523e8dbfa95fd2398fee7958171141e89a656d105c326412e204eb2
                            • Instruction ID: c77069d464b5774904aa67275f9171dcdecd450112bc89640c84c3500efe61b3
                            • Opcode Fuzzy Hash: dd040c53f523e8dbfa95fd2398fee7958171141e89a656d105c326412e204eb2
                            • Instruction Fuzzy Hash: 03F052F3F0C2996FFB110E590C107BA3F12EBD5A9130A416BE805AB261D772C812A390
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: f2e8b548c425bc6bc6598b4fecba795a999cb084d3aac40a458beccc97631fde
                            • Instruction ID: f36802a9a58d951fb37f513dfb984a22fdfa82de5ba2227980230d5c0ed2155f
                            • Opcode Fuzzy Hash: f2e8b548c425bc6bc6598b4fecba795a999cb084d3aac40a458beccc97631fde
                            • Instruction Fuzzy Hash: C3F0BEB2606218AF8701CEA0E8008EABFEAEF8A211704449BE541C7211DA329E0187E2
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 122adb0b136ecb4a9f7a848c40b5a9d6389fafc27722cd39b524d28b9381e74b
                            • Instruction ID: 734a4ff88e39a8774e12b80127d50e858fed7cfc4179a9befedbe4a766832776
                            • Opcode Fuzzy Hash: 122adb0b136ecb4a9f7a848c40b5a9d6389fafc27722cd39b524d28b9381e74b
                            • Instruction Fuzzy Hash: 95F0BE363152498FC701DB68E880DA9BBAAEF4A61931440A6F605CB232C632EC10CB50
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 2c9ce9719fd1634a729a22e36143944bee78ba65c068bad19eda8374499a6b99
                            • Instruction ID: 28cd7b9aa630dedce8b03ac88d0fbae7efb5da04ef1f0d1380ae2a54ebe61697
                            • Opcode Fuzzy Hash: 2c9ce9719fd1634a729a22e36143944bee78ba65c068bad19eda8374499a6b99
                            • Instruction Fuzzy Hash: BCF0FE353106118FD758DA3ED85486A77EBAFCE66135980B9E606CB370EEB1EC029650
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: b5f4b1b7ba6b073cdd2864b48739bd9f08c6a83889d5d5f51c52b76c8292c519
                            • Instruction ID: 2ce2aaa6b3f23404899febd9ede6db9b1c67e2df17475d25a5233a5075bb0914
                            • Opcode Fuzzy Hash: b5f4b1b7ba6b073cdd2864b48739bd9f08c6a83889d5d5f51c52b76c8292c519
                            • Instruction Fuzzy Hash: 97F08170901204DBE715DF50D519BEE7BF6FB89300F204569E4017B384CBB65D05DBA0
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 6200d5320175b5127828486e39f782b5a8bdd156d074c16640d149c4f0b4416a
                            • Instruction ID: 6f377776e2548fec85222bb34ad968fe995058837898df645926ba796cf28e49
                            • Opcode Fuzzy Hash: 6200d5320175b5127828486e39f782b5a8bdd156d074c16640d149c4f0b4416a
                            • Instruction Fuzzy Hash: 4AF054B22053906FD3228A66D950893BFE6EF8625035980A6DD48C7752E721DD4AC7A1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 1dcb532ce2b9ccc1ea2b2e78509a401239dd4e70e2060f4738c9aadec146667d
                            • Instruction ID: 504f926b7c70a76cb1a15b1d18a60ea163c78e35aa678bbaa60767a31c951eef
                            • Opcode Fuzzy Hash: 1dcb532ce2b9ccc1ea2b2e78509a401239dd4e70e2060f4738c9aadec146667d
                            • Instruction Fuzzy Hash: 8FF01971A112198BDB18AB64C8147DEBBB6BB88700F20456EE401BB384DBB95C06CBA5
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: cf431f35c9cb2497c9ffc621d1860407d34192b592d43fd3c9b5b2b7269cd6d1
                            • Instruction ID: ed4f691ac05f23d6d84118e73b9bea90205ffc55ab385c4996536fc486c49e06
                            • Opcode Fuzzy Hash: cf431f35c9cb2497c9ffc621d1860407d34192b592d43fd3c9b5b2b7269cd6d1
                            • Instruction Fuzzy Hash: A9F024303023094BEA04FB38E01069D37DAEFC2105B008668D0058F381DF76AE0B87C1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 2e21c10ab91743dec9b9013bf08cf58d787c20726009ede4aa34f244ab45ceca
                            • Instruction ID: 795c7043b123b6592cd8953952e1d7095f54639704e10d9a53411d325fbe6518
                            • Opcode Fuzzy Hash: 2e21c10ab91743dec9b9013bf08cf58d787c20726009ede4aa34f244ab45ceca
                            • Instruction Fuzzy Hash: 02F01271D002099F8B50EFADD8409DFFBF9FF98650B50453ADA09D3201E77059169BE1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 24b9c87025d5f0966ab6973bae5930b3123f13f09987f72c60e64e47b49c4379
                            • Instruction ID: c9030df78c2444c54aafe1143cf1a1d7903d68bc651859f24f3a229770da9f06
                            • Opcode Fuzzy Hash: 24b9c87025d5f0966ab6973bae5930b3123f13f09987f72c60e64e47b49c4379
                            • Instruction Fuzzy Hash: 2DE065A172E28ACFDB2706B428242F17FB8AE13211B0901D7DE4BCB943C90289098332
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: cb67b1532fe2d8a650013535e2f3cb1289b32fea2e7bda5102ec5a2d2f7b0a37
                            • Instruction ID: a9b66cec45884b7556d0f72e9f90990e7a0252a9e75445b2f8805e41c763e56d
                            • Opcode Fuzzy Hash: cb67b1532fe2d8a650013535e2f3cb1289b32fea2e7bda5102ec5a2d2f7b0a37
                            • Instruction Fuzzy Hash: 59F08231414B489DC701FBB8D8104E9FBB4EE82250B04C78BE4886B122FB30E6D0C7D2
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 241d20cbf0606c632c1652da73bbd6e278dc15af5928d21de802eb5fd0e2d5bc
                            • Instruction ID: 59896cf76fbcbcd4903aa5070ffbd9de8fc49cce0b60e335aa92264e6d9ad624
                            • Opcode Fuzzy Hash: 241d20cbf0606c632c1652da73bbd6e278dc15af5928d21de802eb5fd0e2d5bc
                            • Instruction Fuzzy Hash: 79F01275B00115DFCB04DF54D9808AEB7B5FFC83217204169D90597365CB31EC42CBA1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 4cbd203b7c61ea3cafb795e0a2d9ca53c0068d1f7a07f3b7f46d784208bda37e
                            • Instruction ID: e248fb7dda1972d189e86db426ec9709981a15d7475e7738754085e2906e18f1
                            • Opcode Fuzzy Hash: 4cbd203b7c61ea3cafb795e0a2d9ca53c0068d1f7a07f3b7f46d784208bda37e
                            • Instruction Fuzzy Hash: FAE048362052987FC702DE94DC11CF77F7DDE4A1217088097F954C7252CA629E11D7B1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: ef6f9044ad0610c8f9b2a0349e0e15325280754eddbd29ca7124530712b29345
                            • Instruction ID: cb512d5a6ea3e57f0f1986c40d0b9eea7d9b024a6acf665867e81daf65e18363
                            • Opcode Fuzzy Hash: ef6f9044ad0610c8f9b2a0349e0e15325280754eddbd29ca7124530712b29345
                            • Instruction Fuzzy Hash: 0BE04F32101118BFCB019E84EC01CE6BF7AEF89260704805BFE0987621CA739D629BE1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: a4cf7337eba1100fc3af9fd902726a64734eae62c7fcae2099292a7a66a994e1
                            • Instruction ID: f42fe8a56752d5c2b09bc5883f6e09ae4b167006732068aa8936e93424fbe388
                            • Opcode Fuzzy Hash: a4cf7337eba1100fc3af9fd902726a64734eae62c7fcae2099292a7a66a994e1
                            • Instruction Fuzzy Hash: 33E046763001249BC7109A4EE404D9ABBAEEFD9771B04813BFA08CB320CA72DC52C6E4
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: ccea045c2aa41c33e41193a37daf44e629d7e9df4184b79d5bfc572a4b8755b3
                            • Instruction ID: abde1e0ed8c6602f7ea9a397c2dbc34ebae3790642364a48dad8c2bdd114c7f3
                            • Opcode Fuzzy Hash: ccea045c2aa41c33e41193a37daf44e629d7e9df4184b79d5bfc572a4b8755b3
                            • Instruction Fuzzy Hash: 47E01A362092A86FC7028A94EC11CE67F6DDA46121704849BF99487252DAA29D12D7B1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 2e861971d8014baef6d65b49b25c0a9eaf63ea20dbb9a4aae7474a1f82c6f8b0
                            • Instruction ID: 0662c7c32d643425c8b288cc10dafe87b2969484023b3be9806645004123a649
                            • Opcode Fuzzy Hash: 2e861971d8014baef6d65b49b25c0a9eaf63ea20dbb9a4aae7474a1f82c6f8b0
                            • Instruction Fuzzy Hash: F5E0DFA1509288EFC302CBA098049DABFECDB07110B0101DBE804E3112EA325A0087E1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 8f393449012a3b1986746ea424f062d9e03b75a830406f10521e7e1e3be9470a
                            • Instruction ID: eab09ca101f8fbed2111d20cf0c81086a64f7299f9e32fe1298b1c2b917463bc
                            • Opcode Fuzzy Hash: 8f393449012a3b1986746ea424f062d9e03b75a830406f10521e7e1e3be9470a
                            • Instruction Fuzzy Hash: 1CE06D30E0430CABDB40EFA8E40569CBFB4AB89600F0089E8D408D7300EB341B148B82
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 84e68a414d50b7f083df81cae4d839ed746f4035e7969dfd42a923b8ecbd3950
                            • Instruction ID: 5e811a4aac62d2645f1f91b4b2201465c2df9cf1fa7ad928e90f68a71d47f4af
                            • Opcode Fuzzy Hash: 84e68a414d50b7f083df81cae4d839ed746f4035e7969dfd42a923b8ecbd3950
                            • Instruction Fuzzy Hash: 80D02B6614F3891F8B0A63702C23CE77F1C4C43052B0403EFEC85494539901555882F3
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 0e76369fe708147081306bb5abf21fb0a06c66ac796c382d75404774fb06565d
                            • Instruction ID: e43b29d13549bcbaa5ca32dc749e85d79f3c69a2c30c5115e59723b8cdc9287b
                            • Opcode Fuzzy Hash: 0e76369fe708147081306bb5abf21fb0a06c66ac796c382d75404774fb06565d
                            • Instruction Fuzzy Hash: 5ED0C7F335D1630DE22290547C403E19714D752279F5655B3DD61C9152D40D855B62A1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 330492b9e68f27009dc3d4f36e5aa9bad5ad6a440f4bc789ccdc7e80ec1f49cf
                            • Instruction ID: 5124aaea01a39d642f03f72256accac6f0a3d9f1c0055269395910fb273adb6c
                            • Opcode Fuzzy Hash: 330492b9e68f27009dc3d4f36e5aa9bad5ad6a440f4bc789ccdc7e80ec1f49cf
                            • Instruction Fuzzy Hash: 88E086B1306A619FCB261F2894194E47F619F4361538901DBD15387556C735390ECB81
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 73bff5bf18aa817784857315c205cbd89bdf5586ee8cb920dcaf55d893f78575
                            • Instruction ID: 582c894aba3d60cbc23f166be4c724f4072a3730671009857eaa234321880417
                            • Opcode Fuzzy Hash: 73bff5bf18aa817784857315c205cbd89bdf5586ee8cb920dcaf55d893f78575
                            • Instruction Fuzzy Hash: BFE08C7280A348EFCB02DBB5A80049F7FF9AF462207105BEBD524C71A1E9319A049792
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: f01f7a9decafe06957f4b6756bcc72892401fd5f4e347bd9ed2731f6a19c91c2
                            • Instruction ID: bdeb64f99d6047445f967388ef937138629a568fc56415162c4dc591a1d4eb7e
                            • Opcode Fuzzy Hash: f01f7a9decafe06957f4b6756bcc72892401fd5f4e347bd9ed2731f6a19c91c2
                            • Instruction Fuzzy Hash: C6E0DF3140C3888EC303ABB8D810490FF74DE83200B08C5CBE4889F163EA22E582CB92
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: f3951f37aa8ad595af275d2eefc24fe5b69fbe079aa54994d9fd8d690885cd3c
                            • Instruction ID: 3475e0569bbc55dea36ee0fbe69d1a35c11c3888fc464bc9418801b16be47791
                            • Opcode Fuzzy Hash: f3951f37aa8ad595af275d2eefc24fe5b69fbe079aa54994d9fd8d690885cd3c
                            • Instruction Fuzzy Hash: 57E06DB0A60259DFEB14EF90C554EEEFB71AF90304F70845AC821AB355DB305A12DF80
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 17dd722e370aee58ddc9d07cc91da54d4b4005a5fc786de36bca9927294a3ddb
                            • Instruction ID: d34481280bd57cd7b5882a4c12bdafb2026140c5de322e356b27662d957dc408
                            • Opcode Fuzzy Hash: 17dd722e370aee58ddc9d07cc91da54d4b4005a5fc786de36bca9927294a3ddb
                            • Instruction Fuzzy Hash: 96E0C2F53002386B8204BB54C1108AE37DABFC811130143E8D54C4F762CF20AC0087C6
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: b55b1ab93aef7b512fce7ba12954a57bbef82b01d3d6bf9023f81a18827a7b8f
                            • Instruction ID: 7d4e6a1bbc7e0dcdbe7f8382189cb75107b5f09247a1f220bc6be1a275ee9f3d
                            • Opcode Fuzzy Hash: b55b1ab93aef7b512fce7ba12954a57bbef82b01d3d6bf9023f81a18827a7b8f
                            • Instruction Fuzzy Hash: 76D05E3B314414EB9B051A48F4048FE3FABEBC8762724C02BF819C3700CE768E16AB94
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: ee6851ead1fdc8dad0be9c150eddd067884f8928b7a072780bb6566b4cf16e93
                            • Instruction ID: 5bb5fb2cdb09a58b9bae0faf9ec0f84186e2b605b1f614a1be50ece66cdd88c0
                            • Opcode Fuzzy Hash: ee6851ead1fdc8dad0be9c150eddd067884f8928b7a072780bb6566b4cf16e93
                            • Instruction Fuzzy Hash: 74E0E531814B0989C700FFA8C8518A9F7B4EF95200F00C78EE8886B222FB31E6D1CA81
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: a2edae8ac1f6bf057e822da911f0842425fc7712d2bb91b5c94ffb4001282a43
                            • Instruction ID: 50f9ec82bb1ebb7c59c20051b0a8a8ded0c0f3039545ff97d9cda45ee79bd19e
                            • Opcode Fuzzy Hash: a2edae8ac1f6bf057e822da911f0842425fc7712d2bb91b5c94ffb4001282a43
                            • Instruction Fuzzy Hash: 35D0A7E770405CCFC10D628CB5608EC7B70FA87061BC00193E20FDB552D204990B5B51
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: ffdaa8779fefae3b73f4441e0a10e489f2cbfc4dc6d8e3e95760504f7e339641
                            • Instruction ID: e015a1db4b02d04edf7799318dff45ed5ab9a057321429209e03508f5f7c9ed0
                            • Opcode Fuzzy Hash: ffdaa8779fefae3b73f4441e0a10e489f2cbfc4dc6d8e3e95760504f7e339641
                            • Instruction Fuzzy Hash: BAE0B670E0430CAFCB54EFA9D44559DBBF5AB88700F0085E9E809E7350EB345A158F81
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: b27780dcbefe67ebb4a8091df60a03cf150c21103f72b00dfd74b030924ea619
                            • Instruction ID: 9c6f8816e772b7a1659dbb6dfb0bcccf29a205dabaad8c76b946d0121ff2181f
                            • Opcode Fuzzy Hash: b27780dcbefe67ebb4a8091df60a03cf150c21103f72b00dfd74b030924ea619
                            • Instruction Fuzzy Hash: 31D05E7210D3916FC306CA14E8108E2BBB9AFC6614705888BE8C49B362CB619D47C7A1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 81da24176cf80ca07ea8dc5177cf5b4ad998df23b2d6fecf32289b021c35f04a
                            • Instruction ID: 5072356517ed664370b251c555daaf9b672451bdfb5ab42df29a59e69e39ece7
                            • Opcode Fuzzy Hash: 81da24176cf80ca07ea8dc5177cf5b4ad998df23b2d6fecf32289b021c35f04a
                            • Instruction Fuzzy Hash: 41D0122530A1441FC347862CAC11AE2FBAACF8B21631981EFF448D7257CD139D0787A0
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: e3f2370aa7eed65fda4ca427d8cb05c65c6df8c4b4b6778edef286f3ef06e189
                            • Instruction ID: caa00a447835f9f8d04381ca277fdaf3d80e4199a1c9bc8bd57278cff9c2a331
                            • Opcode Fuzzy Hash: e3f2370aa7eed65fda4ca427d8cb05c65c6df8c4b4b6778edef286f3ef06e189
                            • Instruction Fuzzy Hash: 18D0A9B6304028AF6A062A01A8948FFAF2BE7C02B0790800BF80959200CE324C23A3A0
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 6cfdaf3ffa7f464017986ca106c67d828a35e6139d33c76037ffe35daa6c49e8
                            • Instruction ID: 70e6cb41276596ea72380f62f44c2949f28c09158e9eedfbb985c6a755361948
                            • Opcode Fuzzy Hash: 6cfdaf3ffa7f464017986ca106c67d828a35e6139d33c76037ffe35daa6c49e8
                            • Instruction Fuzzy Hash: 79D0A7A120A6402FC302D611CC118D27F609B9B360B58C19BD54D8F396C522A803CB91
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 8ab869af69afa5e3705abfa003fbeb05737d94153e11a484e1e7a4c73e3e153c
                            • Instruction ID: d8e6f52d84d0e9a7535ad6c92223e7db018a165c074aefbb2bfd7201b7f166f6
                            • Opcode Fuzzy Hash: 8ab869af69afa5e3705abfa003fbeb05737d94153e11a484e1e7a4c73e3e153c
                            • Instruction Fuzzy Hash: D3D05E322001187F8B00CE88DC00CA67BADEB89220B04C05AFD5887241CAB2ED22DBA0
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: fc9bf8a06267e75b45f2b77c085ce015e9f9be9813f032a3f04b5729a1259a7a
                            • Instruction ID: 1f67d902fbfcc961551183db6e36e1e49d129d35cafdf36616c8053a8ff01f8b
                            • Opcode Fuzzy Hash: fc9bf8a06267e75b45f2b77c085ce015e9f9be9813f032a3f04b5729a1259a7a
                            • Instruction Fuzzy Hash: 7ED05E703047504FC326CA18C8A0452BBB59F9B220704C4AFE58AC7662D721BC93CB51
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 8ab869af69afa5e3705abfa003fbeb05737d94153e11a484e1e7a4c73e3e153c
                            • Instruction ID: d8e6f52d84d0e9a7535ad6c92223e7db018a165c074aefbb2bfd7201b7f166f6
                            • Opcode Fuzzy Hash: 8ab869af69afa5e3705abfa003fbeb05737d94153e11a484e1e7a4c73e3e153c
                            • Instruction Fuzzy Hash: D3D05E322001187F8B00CE88DC00CA67BADEB89220B04C05AFD5887241CAB2ED22DBA0
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 0fe6e3aea478687c158d19a34a902664cc9df0a88a38a6ac68c528960ef1b384
                            • Instruction ID: 29f6224dccce5c91cfde4dbcf6ef2d8eab8ae5265d8597ad401a6bfe491303de
                            • Opcode Fuzzy Hash: 0fe6e3aea478687c158d19a34a902664cc9df0a88a38a6ac68c528960ef1b384
                            • Instruction Fuzzy Hash: 44D06236100119BF9B05DE84DC41CA67B6AEB89660714C05AFD1547211C673DD22DBD0
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 25b253dbaaa78eb8b927e5123eb626de7a43b5d8d968444231d991affd7dc476
                            • Instruction ID: 367850f29e0944da511d838f6e65150840b13c1933c75001733d22df0857fb98
                            • Opcode Fuzzy Hash: 25b253dbaaa78eb8b927e5123eb626de7a43b5d8d968444231d991affd7dc476
                            • Instruction Fuzzy Hash: 2BD0C27950D2405FC306CB14EC0482ABBE69FC9600B05C4CEE88483222C565EC06CBB3
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: bbdbcbb62961816584396e17453c9af336873f9fec7b0a5c4a471a2b098543ab
                            • Instruction ID: d2c5166a0acb99c21d70d205175bbec04db4ca8ad023ac91494d863d0841bf70
                            • Opcode Fuzzy Hash: bbdbcbb62961816584396e17453c9af336873f9fec7b0a5c4a471a2b098543ab
                            • Instruction Fuzzy Hash: ACD09E253096905FC346C664DC658A2FBB99F86151714C19FA448C7252DA21AD02D7A1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 8b7213ec0f0baf8a92b88a71e32804a1210a693508da54b3186702a575c1122e
                            • Instruction ID: d0d0722fa6976d802fe4cc59018733cf721eb5526320083564caaf5f63648be1
                            • Opcode Fuzzy Hash: 8b7213ec0f0baf8a92b88a71e32804a1210a693508da54b3186702a575c1122e
                            • Instruction Fuzzy Hash: 5FD0A7353096405FC301C664CC14C93FBB4DFCA211704C0AFE148C7352DA31AD02C7A1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 3ce1b995c2b34e16a964219dcf62cf95c432e0a094a1be20c9b9513adc22bf8e
                            • Instruction ID: 7fff35bb6d7f2b58668a33fdfd4ea50546fd0e0477690fad40ccb8e68e8dcabe
                            • Opcode Fuzzy Hash: 3ce1b995c2b34e16a964219dcf62cf95c432e0a094a1be20c9b9513adc22bf8e
                            • Instruction Fuzzy Hash: 53D0C91130A2915FC74792259C244A6FFB9CB87011318C5DBE048DF257EE22A9078761
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: de764214f689feed01f64e5a43eaa04ba264a6935eaa89cc64d7b9e5a3bc5d19
                            • Instruction ID: 7f32c99d8a9fb4a9c99cfbf8895878934e44adadeeb945271236c07cf335784b
                            • Opcode Fuzzy Hash: de764214f689feed01f64e5a43eaa04ba264a6935eaa89cc64d7b9e5a3bc5d19
                            • Instruction Fuzzy Hash: 8AD05E711182802FC302872088164C5BBA08E52224715C6DBC460CF1A3CA2B8A838750
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 6ccc17e32f5f8054541f2db73882f8cef55c2e1a75d2991b0416dc6ed5ae7bd7
                            • Instruction ID: 76a8db822f9b8813b2cf210dbf4b0c77d115831112aa5a6e40e90224b7920f5d
                            • Opcode Fuzzy Hash: 6ccc17e32f5f8054541f2db73882f8cef55c2e1a75d2991b0416dc6ed5ae7bd7
                            • Instruction Fuzzy Hash: 3DD0A970200A208FCB241A1AA00E09AB7AAAB41A26B00015AE50743200CBBA690A8FC1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 5c11810801e250d42402db69069694f6384a6c6b8795b16c9fc790fa0372b30b
                            • Instruction ID: cf2e93f195aff74427bb3c3b964d6a151c8cb9d6844a6652eb7d43cb2bef656b
                            • Opcode Fuzzy Hash: 5c11810801e250d42402db69069694f6384a6c6b8795b16c9fc790fa0372b30b
                            • Instruction Fuzzy Hash: B2D0C9B190120CEFCB00DFA4D90599EBBFDEB49201B1085E6D909E3210EA329A109BD1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: de2c31d3fec41616892621f363e1d9021cabc0f8e45271d193b0610391385600
                            • Instruction ID: 9a70f00652bf6f2368b166ce7dec97c2fb092f0c4f95ee6d0f12e91542eb6e31
                            • Opcode Fuzzy Hash: de2c31d3fec41616892621f363e1d9021cabc0f8e45271d193b0610391385600
                            • Instruction Fuzzy Hash: 03D0127011A7845FC7474B64DD20888BF34DF83248714C4D6E848CF5A7CF318A0AD7A0
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 1feb360d6317a0c4227a1c1c2f65bd69940c796e492ebd1ca05c50132e920ee4
                            • Instruction ID: 03c354c23090af15835c1f9691955f0c4564bfbe8524e3e65f40b6813bdcec80
                            • Opcode Fuzzy Hash: 1feb360d6317a0c4227a1c1c2f65bd69940c796e492ebd1ca05c50132e920ee4
                            • Instruction Fuzzy Hash: D4D0C9B190120CEF8B00DFA5990059EBBEAEB89540B1049EA9509D7210EA329A1057D2
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: abb29ab9e8f7706d073b656a8c72ed8e8053cc1a194722db7afbefa38311c0c1
                            • Instruction ID: 6bef65809bdd9b12112dbb6953cf10c541c4fbfc9e21b0902c8b79f69f80d7cf
                            • Opcode Fuzzy Hash: abb29ab9e8f7706d073b656a8c72ed8e8053cc1a194722db7afbefa38311c0c1
                            • Instruction Fuzzy Hash: D5D0223890530AEBE230EBA8A400BD0BB9CEB46A11F0082DAE40483620CB31562043E2
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 74e2bb6611e5e0eb28be6fb9f3d4479163606052e5271a8b76d6fb244c44155c
                            • Instruction ID: 34cfa719e49de147315d328afdfb8061113d167c22f2b18225cdae86a7d069c5
                            • Opcode Fuzzy Hash: 74e2bb6611e5e0eb28be6fb9f3d4479163606052e5271a8b76d6fb244c44155c
                            • Instruction Fuzzy Hash: 66D09276B002148FDB44EBA8E858A9CB7B1FB88226B1044A6E51AD7261DB3199118F10
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 9bca63931b5bf0adde1ee8df195e553df1f3245bb20d22b6bba6029b4999f081
                            • Instruction ID: 4565025f28fc256174af24ade86436c76d028fc1cae6a8f12a4bec0419c52476
                            • Opcode Fuzzy Hash: 9bca63931b5bf0adde1ee8df195e553df1f3245bb20d22b6bba6029b4999f081
                            • Instruction Fuzzy Hash: CAD09E314147099AC700FBA8D851855F7B8EFD5210B14C65EE84D5B222EB71E691D681
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 6b8de915e0111b85c079312c1ed7c1ec837ac6f62600a3eb9086d34c317ed545
                            • Instruction ID: d330bcf0d218a0ee0de2c675a452981c592e118248aebfbd0c251dc10f7c9528
                            • Opcode Fuzzy Hash: 6b8de915e0111b85c079312c1ed7c1ec837ac6f62600a3eb9086d34c317ed545
                            • Instruction Fuzzy Hash: D8C09B6510F6D46FCB0317B06C154D17F78ED6722670547C3E241C6057D6190504D7F1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: e6794fb2ad97ad49b9968fe1c6318cf8d7f1a61b551986c032b483786ecec9b2
                            • Instruction ID: 51fe389ec560a0e69a839db2a533e7227cc3924b27c2b3b1e75e370998b70de8
                            • Opcode Fuzzy Hash: e6794fb2ad97ad49b9968fe1c6318cf8d7f1a61b551986c032b483786ecec9b2
                            • Instruction Fuzzy Hash: FEC04CFC6012015FE3449F218984B27BEE3EBD8706F51C49DA1458A668CF748851DB95
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 92eb6fd45e884c3bc27b7fcac4154b984a2e350fc13cca155653abd73719f174
                            • Instruction ID: 63e5df68b0894ab74bb5709ce1230d646e354dd0b65bd552a2fcf174219b1fcb
                            • Opcode Fuzzy Hash: 92eb6fd45e884c3bc27b7fcac4154b984a2e350fc13cca155653abd73719f174
                            • Instruction Fuzzy Hash: F9C02BB1304240B7D303FB60A901BB53FE1F31C301F084020F104C0401C3EC5021D722
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: dad4d205aa17d4fd5af3a97c28eabe717add3c12f38c76a45c275cd9d80a4d4a
                            • Instruction ID: dab34cf7c44f641145ed34ff4ea3dc3d0cbf95765984d95f115f61359cb4c52b
                            • Opcode Fuzzy Hash: dad4d205aa17d4fd5af3a97c28eabe717add3c12f38c76a45c275cd9d80a4d4a
                            • Instruction Fuzzy Hash: 6EB0927090530CAF8620DA99980195AB7ACDA4AA10B4001D9F90887320DA72AA1066D2
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 16581dba91a5fda841cf47983153eb36e4fc24851952f78b75638f70de6cde10
                            • Instruction ID: 60a72056a403d9f31dd85fef4a7a76d12bb133d0d450fb6ef353260f5a4d9492
                            • Opcode Fuzzy Hash: 16581dba91a5fda841cf47983153eb36e4fc24851952f78b75638f70de6cde10
                            • Instruction Fuzzy Hash: 0BC09274300100AF8348CA18C895C26F7E6EFD8214B24C46DB84DC7365EF32EC03CA10
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: d82b248f5684be0a21ee006a9accfe40f24566b6069073d92eb4d3d909e5bc11
                            • Instruction ID: 2dd2843183a4f7000597dd8af5b28e02d71a07ec6b5c743607377e827fcaa7c9
                            • Opcode Fuzzy Hash: d82b248f5684be0a21ee006a9accfe40f24566b6069073d92eb4d3d909e5bc11
                            • Instruction Fuzzy Hash: 54C09B513152484BFB05D565D5517592741C342204F958558C80457B94C55DCC55CB51
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 0e044445334100dabf49ad19235f7c4a96278e1518668eabb6fa5c8112e73a96
                            • Instruction ID: fe88e69fd4c6831db2c423ab8c88e52eed8da43e27158f3785f1abcdcfbbc2c3
                            • Opcode Fuzzy Hash: 0e044445334100dabf49ad19235f7c4a96278e1518668eabb6fa5c8112e73a96
                            • Instruction Fuzzy Hash: 0BB0927100470E6FC600BB68E887A44375CE98050A7804161AC0CA9629DBEC68844796
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 696e09bcfb64818fd7276400d52c6ae3f2a7925e163e7d1e99028b2e0380b337
                            • Instruction ID: e227c29a59f571234b47dc22ed730269549dbcccf57689a992f52000cc23fb19
                            • Opcode Fuzzy Hash: 696e09bcfb64818fd7276400d52c6ae3f2a7925e163e7d1e99028b2e0380b337
                            • Instruction Fuzzy Hash: 9FC08C2101E1C00EDB02972898296C07F308B42205B0840D6C088AB1A3D2A9158ACA50
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: e1ba7cbb3096e51ec34f5a7eacdb2e6acbf54fe60aba0da8e109decd34447148
                            • Instruction ID: 1bf4d38333e9f2b5e1f7803685775dc1c80482e82706c12ab4a2c0fe591b99d7
                            • Opcode Fuzzy Hash: e1ba7cbb3096e51ec34f5a7eacdb2e6acbf54fe60aba0da8e109decd34447148
                            • Instruction Fuzzy Hash: 70B01237B0001986CB04E6C9F8404ECFB30DBD4332F004033C30072040873125BAC764
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 0764a19e45510c97ff0766c0b576a6fd96dbbc67e0c728127d73f15c12044389
                            • Instruction ID: dd7b6b1ff3585b1cac13028cfaf50965c698edf59ebd00cd25c8917c79e3e927
                            • Opcode Fuzzy Hash: 0764a19e45510c97ff0766c0b576a6fd96dbbc67e0c728127d73f15c12044389
                            • Instruction Fuzzy Hash: 01B0123000070E4FC5007B68F847A04371CE9805067804120EC0C191199BEC2C4447D6
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 848e7b2b3d1d7438aceb18ee9ce77d60f8a3148b9db338e3d364b5add5ce48b1
                            • Instruction ID: 424522431131923360a2424e5b60fcaca403654da384226d21dcd1d1d325544f
                            • Opcode Fuzzy Hash: 848e7b2b3d1d7438aceb18ee9ce77d60f8a3148b9db338e3d364b5add5ce48b1
                            • Instruction Fuzzy Hash: B3A001746050109B8689DA58D991818B7A2ABC9219728C4ADA819CB25ACF33E9039A44
                            Strings
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID: %
                            • API String ID: 0-2567322570
                            • Opcode ID: 846a4b8b33bba01b467b8e81892f3971902fd24d46a076cb3d95233deb950b12
                            • Instruction ID: 1ea84aa9b900ff4847e67100245e631f2877762f5a57c4f5f134ae7ac28b0902
                            • Opcode Fuzzy Hash: 846a4b8b33bba01b467b8e81892f3971902fd24d46a076cb3d95233deb950b12
                            • Instruction Fuzzy Hash: AA024CB4A00215DFDB14EFA9C444AAEBBF2FFC8300F50852ED909AB355DB359816DB91
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 20409eea938907a3fe5032c9fe1156874fcc9478a9ea985a8bdf13bf4bf88700
                            • Instruction ID: 6032f8b4fad4c484b6298d7fd202298c0e75b1643e6a5402134eef181736bd06
                            • Opcode Fuzzy Hash: 20409eea938907a3fe5032c9fe1156874fcc9478a9ea985a8bdf13bf4bf88700
                            • Instruction Fuzzy Hash: 1BC209B4A00229CFDB24DF64C984BEDBBB2FF89301F5085AAD50997350DB359992DF90
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 74c7487ef4a6c679905932d58933d4022eec5c1eba2717642155f0a0cc8609c6
                            • Instruction ID: 9ac3bda4caa2d446551ed3324b160ab8513cd8f370c3f7015403316679c5356e
                            • Opcode Fuzzy Hash: 74c7487ef4a6c679905932d58933d4022eec5c1eba2717642155f0a0cc8609c6
                            • Instruction Fuzzy Hash: 8F828D707003058FEB18EF69C894BAEB6E6FFC5700F108569E5069F3A5CBB59D069B81
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840388702.00000000076F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076F0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_76f0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 17efe42a30f2fff3dcfd3dd829f53d96ab6fc7e16beb2417be806e1725da571e
                            • Instruction ID: 1131928c3e36830b035ef67020806939718bfe0936f0ea04e1ddcf6a67dc9ade
                            • Opcode Fuzzy Hash: 17efe42a30f2fff3dcfd3dd829f53d96ab6fc7e16beb2417be806e1725da571e
                            • Instruction Fuzzy Hash: 0192D571D10B1A8ACB51EF68C8809A9F7B1FF99300F14D79AD45977225EB70AAC4CF81
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: b4ae16b8832ee2cb087d5952bc9aabbd5892fbfb21023a953a94889b66437f41
                            • Instruction ID: 0d298665e418caefcf380af33c5caf83fa72703d5115f01334e0e09c0b5492b2
                            • Opcode Fuzzy Hash: b4ae16b8832ee2cb087d5952bc9aabbd5892fbfb21023a953a94889b66437f41
                            • Instruction Fuzzy Hash: F6824DB4A00225CFDB18DF29C944AA9B7F6FF88300F15859AD84A9B361DB30ED81DF51
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 856d6854a6cf676bb522f9eb76ad1d0249cafbc06c984932f07b81a895c54b6d
                            • Instruction ID: 6b37493b65e2ab03154a9544d01c24ca96ae981bd6c12ff01d525dd1be17c3f5
                            • Opcode Fuzzy Hash: 856d6854a6cf676bb522f9eb76ad1d0249cafbc06c984932f07b81a895c54b6d
                            • Instruction Fuzzy Hash: 5A621BB06002019FE748EF58C45879ABAD6EBC4308F65C55DD00D9F792DBBAD90B8BD1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 9b5a07022faf16fe1c0649befd12253fc31da1843e3258c18c88e053aa121268
                            • Instruction ID: 64c0d36ab1a756279bacad02887459ed035010b466f7a948686a7fbf2f1763a8
                            • Opcode Fuzzy Hash: 9b5a07022faf16fe1c0649befd12253fc31da1843e3258c18c88e053aa121268
                            • Instruction Fuzzy Hash: 76620BF06002019BE748EF58C45879ABAD6EBC8308F65C55DD00D9F792DBBAD90B8BD1
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840069077.0000000007420000.00000040.00000800.00020000.00000000.sdmp, Offset: 07420000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7420000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 41878624d222f43265bb1dcdc9d361881b7ef460cbcb015e2331c60b365840cd
                            • Instruction ID: 228ea9c57f4a534dfa33643a8c8c4e6fa85f0401b26acee062bbd18c118d09f4
                            • Opcode Fuzzy Hash: 41878624d222f43265bb1dcdc9d361881b7ef460cbcb015e2331c60b365840cd
                            • Instruction Fuzzy Hash: A0E191B0A0021A9FDB15DF68D840ADEBBF2FF89300F14856AE445AB351DB30DD56CB91
                            Memory Dump Source
                            • Source File: 00000000.00000002.3837716619.00000000010C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010C0000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_10c0000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 8a2c6cbc10a0215b719c5ae6a741e1986c0854579b7aed9fc5eb9ae44d55a5d6
                            • Instruction ID: 30521211567e994a4e5b51be88fc152a93ad4f4f01778d48ccdba58a029ae798
                            • Opcode Fuzzy Hash: 8a2c6cbc10a0215b719c5ae6a741e1986c0854579b7aed9fc5eb9ae44d55a5d6
                            • Instruction Fuzzy Hash: FFA15B32A0020ACFCF15DFA4D9445DEBBF2FF94700B1585AAE905AB265EB71E905CF80
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 89aa06ef4b27776395e78ba4988b311609f9f8ada95d97f3ce81fcc17f310a0b
                            • Instruction ID: 8c0f8041f8710da0abf9196b29ffab27e64c710cd2374dc8bdc36731679aaeb7
                            • Opcode Fuzzy Hash: 89aa06ef4b27776395e78ba4988b311609f9f8ada95d97f3ce81fcc17f310a0b
                            • Instruction Fuzzy Hash: 7A610271A016458FE708FF7AE99069A7BE7FBC8200F14C279D414AB268EB7C5809DB51
                            Memory Dump Source
                            • Source File: 00000000.00000002.3840120489.0000000007440000.00000040.00000800.00020000.00000000.sdmp, Offset: 07440000, based on PE: false
                            Joe Sandbox IDA Plugin
                            • Snapshot File: hcaresult_0_2_7440000_8a984491558f624bf313baf8453d547c0f714822058a2aca540f64dc78e4078f.jbxd
                            Similarity
                            • API ID:
                            • String ID:
                            • API String ID:
                            • Opcode ID: 8e0a73d92e22fcd844b5f095224031d17cb80ddcf8bc106b2c1247f8beaf79c1
                            • Instruction ID: a240b18e367373e51dc05e927f981860702ec5c9608bdf886ecdfa2135db3a42
                            • Opcode Fuzzy Hash: 8e0a73d92e22fcd844b5f095224031d17cb80ddcf8bc106b2c1247f8beaf79c1
                            • Instruction Fuzzy Hash: 3D510171A026058FE708FF7BE99069A7BE7FBC8200F14C279D414AB268DB7C58099B51